CVE-2026-48172LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.
Updated under an hour ago ()
Does this affect you?
It affects LiteSpeed Technologies cPanel Plugin and 3 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 26, 2026; federal agencies had to remediate by May 29, 2026. Treat that date as your deadline.
Do this next
Free account, 1 product
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
- CVSS
- 10.0 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-266
- Known exploited
- Added to CISA KEV May 26, 2026; federal remediation due May 29, 2026Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 1.01% (percentile 63)
- Assigned by
- mitre
- NVD analysis
- Analyzed
- Record last updated
- Oct 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
LiteSpeed Technologies cPanel Plugin litespeed_technologies:cpanel_plugin (from the name) | from 2.3 before 2.4.7 | CNA record |
LiteSpeed Technologies WHM Plugin litespeed_technologies:whm_plugin (from the name) | before 5.3.1.0 | CNA record |
litespeedtech litespeed_cpanel_plugin litespeedtech:litespeed_cpanel_plugin | before 2.4.7 | NVD |
litespeedtech litespeed_whm_plugin litespeedtech:litespeed_whm_plugin | before 5.3.1.0 | NVD |
References
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanelproduct
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-logrelease-notes
- https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48172us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.