CISA urged federal agencies to patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that is being exploited in the wild. The flaw, CVE-2026-48172, has a CVSS score of 9.8 and is described as a privilege escalation issue that can allow attackers to execute arbitrary scripts with root privileges. LiteSpeed fixed the issue in user-end plugin version 2.4.5 after it was exploited as a zero-day. The WHM plugin is not affected. LiteSpeed recommended checking whether server IPs match detected exploitation sources, blocking invalid IPs, and reviewing system logs for actions taken by those IPs. Users were advised to upgrade to WHM plugin version 5.3.1.0 or higher or remove the plugin if patching is not possible. cPanel removed the user-end plugin via a nightly update on May 19, and CISA added the CVE to its KEV catalog with a May 29 deadline for federal agencies.
"CISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild. Tracked as CVE-2026-48172 (CVSS score of 9.8), the flaw is described as a privilege escalation issue that could allow attackers to execute arbitrary scripts with root privileges. LiteSpeed resolved the security defect last week in version 2.4.5 of the user-end plugin, noting that it had been exploited in the wild as a zero-day. LiteSpeed's WHM plugin is not affected, it said."
""This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions between v2.3 and v2.4.4," LiteSpeed warned. It also provided users with instructions on how to check if their servers have been affected, recommending immediate action if potential exploitation has been identified. "We recommend you examine the IPs in the list, determine if they are valid, and if not, block them. To determine any damage done, examine the system logs for any actions taken by the detected IPs," LiteSpeed said."
"Users should upgrade to LiteSpeed WHM Plugin version 5.3.1.0 (bundled with the user-end plugin version 2.4.7) or higher, which contain patches for the vulnerability. If patching is not possible, users are advised to completely remove the plugin. On May 19, cPanel pushed a nightly update that removed the LiteSpeed user-end plugin for all cPanel versions, underlining that the exploited CVE allowed unauthorized root access to the server. On Tuesday, CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it or remove the vulnerable plugin versions by May 29, in line with Binding Operational Directive (BOD) 22-01 guidance."
Read at SecurityWeek
Unable to calculate read time
Collection
[
|
...
]