cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

CISA Orders Federal Agencies to Patch Actively Exploited LiteSpeed cPanel Flaw

· Original article ↗

Summary

CISA ordered U.S. federal agencies to patch CVE-2026-48172 by May 29. The actively exploited LiteSpeed cPanel plugin flaw can let unauthenticated attackers run scripts as root; LiteSpeed released updates.

Key points

  • CVE-2026-48172 affects LiteSpeed’s cPanel user-end plugin, bundled with the WHM plugin.
  • LiteSpeed says versions 2.3 through 2.4.4 are affected and the flaw is being actively exploited.
  • The flaw involves incorrect privilege assignment in the lsws.redisAble function and can allow unauthenticated remote attackers to run arbitrary scripts with root privileges.
  • LiteSpeed released urgent updates and advised users to update the plugin.
  • CISA added the flaw to its catalog of vulnerabilities exploited in attacks and ordered U.S. federal agencies to patch by midnight on Friday, May 29, under BOD 22-01.
  • LiteSpeed provided a log-search command to check for potential exploitation and advised reviewing activity from detected IPs and blocking suspicious ones.

Article Details

Vulnerability Types
  • Privilege escalation
  • Incorrect privilege assignment
Severity
Critical
Affected Versions
  • LiteSpeed cPanel user-end plugin v2.3 to v2.4.4
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Review IPs identified by the vendor's log-search command and block those determined to be invalid.
  • Discontinue use of the product if mitigations are unavailable.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationRemote attackers exploit the plugin flaw to escalate privileges and execute arbitrary scripts as root.

CVE

CVE-2026-48172Litespeedtech · Litespeed cpanel plugin; Litespeedtech · Litespeed whm pluginThe vulnerability, tracked as CVE-2026-48172, can let unauthenticated attackers run arbitrary scripts with root privileges, and users are urged to update immediately or block suspicious IPs.

Vendors

LiteSpeedfederal agencies to patch an actively exploited critical privilege escalation flaw in the LiteSpeed cPanel user-end plugin by Friday, May 29.

Products

cPanelfederal agencies to patch an actively exploited critical privilege escalation flaw in the LiteSpeed cPanel user-end plugin by Friday, May 29.LiteSpeed cPanel user-end pluginfederal agencies to patch an actively exploited critical privilege escalation flaw in the LiteSpeed cPanel user-end plugin by Friday, May 29.WHMLiteSpeed released urgent security updates on Thursday to address the flaw, warning users to update the cPanel user-end plugin (bundled with the WHM plugin) to the latest version.

Countries

United StatesCISA has ordered U.S. federal agencies to patch an actively exploited critical privilege escalation flaw in the LiteSpeed cPanel user-end plugin by Friday, May 29.

Related Articles