CVE Tools
Track your stack

CISA warns of another cPanel plugin flaw exploited in attacks

BleepingComputerBy Sergiu Gatlan

Reported exploitedLiteSpeed cPanel user-end pluginWHM plugin

Our summary

CISA has directed U.S. federal agencies to patch within three days a actively exploited vulnerability in the LiteSpeed cPanel user-end plugin, tracked as CVE-2026-54420. Reported as CVE-2026-48172, the high-severity flaw affects user-end plugin versions before 2.4.8 and can let attackers with FTP or web shell access escalate to root on shared hosting systems running CloudLinux/CageFS due to a UNIX symlink-following issue. This is included in CISA’s Known Exploited Vulnerabilities Catalog, making timely remediation critical to reduce the risk of widespread compromise.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsLiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared ServerCVE-2026-48172, CVE-2026-54420
  2. The Hacker NewsCritical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole ServerCVE-2026-48172, CVE-2026-54420
  3. Daily CyberSecurity (securityonline.info)LiteSpeed cPanel Privilege Escalation Flaw Exploited in the Wild (CVE-2026-54420)CVE-2026-48172, CVE-2026-54420
  4. The Hacker News⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreCVE-2026-54420
  5. Daily CyberSecurity (securityonline.info)2,060 New CVEs and 4 Actively Exploited Flaws (June 15-21, 2026)CVE-2026-54420
  6. SecurityWeekJoomla, LiteSpeed Vulnerabilities Exploited in AttacksCVE-2026-54420
  7. The Hacker NewsCISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege EscalationCVE-2026-54420

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store