CVE-2026-48172

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-48172 9.8

LiteSpeed · cPanel Plugin · Added 2026-05-26 · Published 2026-05-21

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityLiteSpeed cPanel Plugin Privilege Escalation Vulnerability

VendorLiteSpeed

ProductcPanel Plugin

Date added2026-05-26

Due date2026-05-29

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-266

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

NVD: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-26 05:42 UTC

Wall time45s

Searches5

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-48172
https://github.com/HORKimhab/CVE-2026-48172
https://github.com/fevar54/CVE-2026-48172---LiteSpeed-cPanel-Plugin-Version-Auditor
https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/
https://labs.cloudsecurityalliance.org/research/csa-research-note-litespeed-cpanel-cve-2026-48172-privilege/
https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/CSA_research_note_litespeed-cpanel-cve-2026-48172-privilege-escalation_20260525-csa-styled.pdf
https://blog.halosecurity.com/cve-2026-48172-litespeed-cpanel-plugin-privilege-escalation/
https://securityaffairs.com/192795/hacking/u-s-cisa-adds-litespeed-cpanel-plugin-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html
https://www.maxinames.com/blog/litespeed-user-end-cpanel-plugin-privesc-may-2026/
https://www.sentinelone.com/vulnerability-database/cve-2026-48172/
https://sploitus.com/exploit?id=36AAEAF3-4B32-5BE1-817C-7C65B5B446FE
https://www.tenable.com/cve/CVE-2026-48172
https://support.cpanel.net/hc/en-us/articles/40599423437079-Security-LiteSpeed-plugin-automatically-removed-during-nightly-update-May-19-2026
https://github.com/EYoltic20/Tools/blob/main/cve_2026_48172_check.py

QC notes

warn component_extraction: Component 'LiteSpeed User-End cPanel Plugin redisAble.php endpoint (execute/Litespeed/redisAble.php)' matches or contains product name 'cPanel Plugin' — no specific component identified

Hunting hypothesis agent

Hunt for requests to /execute/Litespeed/redisAble.php with shell metacharacters in the redis_server parameter in cPanel access logs — the command-injection vector granting any authenticated user root via the LiteSpeed cPanel Plugin.

Research details

ComponentLiteSpeed User-End cPanel Plugin redisAble.php endpoint (execute/Litespeed/redisAble.php)

PreconditionsThe LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4 expose the lsws.redisAble JSON-API function to every authenticated cPanel user account. Any tenant on a shared hosting server with a valid cPanel session can exploit this. The attack requires: (1) a cPanel server running a vulnerable plugin version (v2.3-v2.4.4), (2) valid cPanel credentials (any user-level account suffices — no admin/root access needed), (3) network reachability to the cPanel JSON-API endpoint (typically port 2083 for HTTPS or 2082 for HTTP). The plugin mishandles privilege separation in its Redis enable/disable feature: the lsws.redisAble function accepts caller-controlled parameters and executes privileged operations with root-level system access without validating whether the calling principal is authorized to trigger root-level effects. A single crafted HTTP POST/GET request to the cPanel JSON-API endpoint with cpanel_jsonapi_func=redisAble and attacker-controlled values is sufficient to achieve arbitrary script execution as root. There is no race condition, memory corruption, or authentication bypass required — the privilege boundary failure is categorical. Exploitation leaves detectable artifacts in cPanel access logs under /var/cpanel/logs and /usr/local/cpanel/logs/ with the string cpanel_jsonapi_func=redisAble. Following initial exploitation, threat actors have deployed Mirai botnet variants and 'Sorry' ransomware on compromised servers. LiteSpeed released an emergency patch (v2.4.5 initially, then v2.4.7 with additional hardening) on May 21, 2026. cPanel also pushed an automatic uninstall of the vulnerable plugin via nightly updates on May 19, 2026. agent

DeliveryHTTP GET or POST to /execute/Litespeed/redisAble.php on the cPanel host (ports 2082/2083) with valid cPanel credentials, supplying enable=1 and a redis_server parameter containing shell metacharacters followed by arbitrary commands executed as root.

Public PoCyes

PoC URLs https://github.com/HORKimhab/CVE-2026-48172
https://github.com/fevar54/CVE-2026-48172---LiteSpeed-cPanel-Plugin-Version-Auditor
https://sploitus.com/exploit?id=36AAEAF3-4B32-5BE1-817C-7C65B5B446FE Third-party repos; verify before use.

Advisoryhttps://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/

Exploit notesExtremely low complexity — a single well-formed HTTP GET to /execute/Litespeed/redisAble.php with enable=1&redis_server=127.0.0.1;<command> achieves arbitrary code execution as root. No race condition, memory corruption, or multi-step chaining required. Requires valid cPanel user credentials (any tenant account). CVSS attack complexity: LOW.

SummaryCritical (CVSS 9.8) privilege escalation in LiteSpeed User-End cPanel Plugin — any authenticated cPanel user can execute arbitrary scripts as root via command injection in the redisAble.php endpoint, actively exploited in May 2026 with public PoCs available.

Tia coverage

First reported2026-05-23

First exploit report2026-05-23

Exploit report → KEV3 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

litespeed-cpanel-plugin-cve-2026-48172-cvss-10-0-zero-day-active

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.