CISA Warns LiteSpeed cPanel Plugin Flaw Exploited in Attacks

CISA has added CVE-2026-48172 a critical privilege escalation bug in the LiteSpeed cPanel plugin to its Known Exploited Vulnerabilities (KEV) catalog and reports active exploitation in the wild.

The vulnerability lets any authenticated cPanel user execute commands with root privileges because the plugin fails to enforce proper privilege separation (CWE-266).

In multi-tenant and shared hosting environments this weakness can let a low-privileged account take over the entire server.

LiteSpeed cPanel Plugin Vulnerability

The flaw stems from improper privilege management in the plugin’s interface. An attacker who has any valid cPanel credentials even an account intentionally limited by the hosting provider can trigger the plugin to run arbitrary scripts as root.

That escalation path removes the usual account isolation in shared hosting, enabling full-system compromise from a single breached or malicious tenant.

Exploiting this issue can allow attackers to:

• Modify hosted sites or replace site content.
• Deploy persistent web shells or other backdoors.
• Exfiltrate data stored on the server.
• Move laterally between accounts or containers on the same host.

While no public ransomware linkage is confirmed, root access is a common milestone for sophisticated attacks and post-exploitation activity, increasing the risk of subsequent data theft or ransomware deployment.

LiteSpeed and cPanel are widely used across hosting providers. When a widely deployed control fails to enforce least privilege, the potential attacker surface multiplies across many customers on a single server.

Shared hosting environments are especially vulnerable because multiple unrelated users share the same underlying host OS and services.

CISA added CVE-2026-48172 to the KEV catalog on May 26, 2026, and issued a Binding Operational Directive (BOD 22-01) requiring remediation by May 29, 2026. The three-day remediation window reflects both reported active exploitation and the severity of root-level escalation.

Mitigation

• Apply vendor patches immediately when available. Patches are the primary fix.
• If a patch is not yet available, disable the LiteSpeed cPanel plugin or restrict access to it (e.g., network-level firewall rules, limit plugin usage to trusted admin accounts).
• Enforce strong cPanel account hygiene: unique passwords, MFA for all accounts with plugin access, and strict privilege assignments.
• Monitor and audit: review server and cPanel logs for suspicious activity (unusual commands, new web shells, unexpected root-level processes).
• Incident readiness: prepare containment playbooks snapshot affected systems, isolate compromised hosts, and collect forensic logs before remediation steps that could destroy evidence.
• Follow CISA BOD 22-01 guidance for cloud and hosted services where applicable.