Critical LiteSpeed cPanel Plugin Flaw (CVE‑2026‑48172) Exploited, Prompting Urgent Patches

LiteSpeed cPanel CVE-2026-48172 privilege escalation CISA warning

cPanel warned users that a critical flaw in the LiteSpeed cPanel plug‑in (CVE‑2026‑48172) is being actively exploited. The vulnerability lets any authenticated cPanel user run arbitrary scripts with root privileges, potentially compromising the entire server and exposing data from other tenants in shared‑hosting environments.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities catalog and issued a three‑day directive for federal agencies to apply the fix by May 29, 2026. cPanel released an update that automatically removes the vulnerable plug‑in, and LiteSpeed published version 2.4.7 addressing additional attack vectors. Administrators are urged to verify removal, install the patch, and consider stricter permission controls until the issue is fully mitigated.

Sources

Critical Vulnerability Alert: CVE-2026-48172 – LiteSpeed cPanel Plugin Root Privilege Escalation Under Active Exploitation - LowEndBox [lowendbox.com]

2 months ago

CPanel waarschuwt voor misbruik LiteSpeed-lek en verwijdert plug-in bij gebruikers [www.security.nl]

2 months ago

CISA Warns of LiteSpeed cPanel Plugin Vulnerability Exploited in Attacks [cybersecuritynews.com]

2 months ago