Reported by 2 outlets

Timeline

1. original reporting

   LiteSpeed cPanel Plugin CVE-2026-48172 (CVSS 10.0) — Zero-Day Actively Exploited for Root Access on Shared Hosting

   gbhackers.com · 144d ago · May 23rd, 2026

   A critical privilege escalation zero-day in the LiteSpeed User-End cPanel plugin is being actively exploited, allowing any authenticated cPanel user to execute arbitrary scripts as root — no race condition, no authentication bypass needed. Tracked as CVE-2026-48172 (CVSS 10.0), the flaw resides in the plugin's lsws.redisAble JSON-API endpoint, exposed to every logged-in cPanel user by default. A single malformed API call is sufficient for full server compromise. The attack surface is massive: cPanel powers millions of shared-hosting servers globally, and LiteSpeed's plugin is widely deployed for its caching features. cPanel forced a fleet-wide uninstall five hours before its scheduled TSR window — a rare emergency measure underscoring active, large-scale exploitation. Patched in LiteSpeed WHM Plugin v5.3.1.0 (bundled with cPanel Plugin v2.4.7). Detection: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/. Any output means the host is compromised — rotate all credentials and audit cron/authorized_keys.

2. update from gbhackers.com

   CISA Adds LiteSpeed cPanel Plugin CVE-2026-48172 (CVSS 10.0) to KEV — Active Exploitation Confirmed, May 29 Federal Deadline

   gbhackers.com · 139d ago · May 28th, 2026

   CISA has formally added CVE-2026-48172 to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation. CISA's Binding Operational Directive 22-01 mandates remediation by May 29, 2026 (tomorrow) for federal agencies.

3. update from bleepingcomputer.com

   CISA Adds LiteSpeed cPanel Plugin Flaw to KEV — First CVE Under BOD 26-04 Three-Day Deadline

   bleepingcomputer.com · 120d ago · June 16th, 2026

   CISA added CVE-2026-54420 (the LiteSpeed cPanel user-end plugin symlink-following vulnerability) to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch within three days under the new BOD 26-04 risk-based directive — making it the first vulnerability subject to the new expedited timeline. The flaw allows attackers with FTP or web shell access to escalate privileges to root on shared hosting servers running CloudLinux/CageFS. CISA also previously warned agencies about related CVE-2026-48172. A detection command is available to check logs for exploitation attempts.