Skip to content
Log inStart free trial

CVE-2026-48172

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.

Critical Known exploited
Severity
10.0 / 10
Critical · CVSS 4.0
Exploit chance (EPSS)
17.91%
Chance of exploitation in the next 30 days. Higher than 97.18% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since May 26, 2026
Weakness
CWE-266 Incorrect Privilege Assignment
Fix
None yet
No fixed version published
Exploited in the wild. LiteSpeed cPanel Plugin Privilege Escalation Vulnerability (LiteSpeed cPanel Plugin). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by May 29, 2026.

Description

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 4.0 10.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
High
Integrity (subsequent systems)
High
Availability (subsequent systems)
High
Exploit maturity
Not defined
Scope
X

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-266: Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-gr2m-v5gq-v685
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Medium Same weakness, CWE-266
GHSA-3w57-8xmc-8v26
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
High Same weakness, CWE-266
GHSA-rh79-75qm-gwjr
Gitea LFS Deploy-Key Privilege Escalation
Medium Same weakness, CWE-266
GHSA-rvmm-v933-jgxq
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
Medium Same weakness, CWE-266
GHSA-8qpj-27x8-pwpq
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Critical Same weakness, CWE-266
GHSA-m2v5-74w2-qhcj
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
Medium Same weakness, CWE-266
GHSA-qmf3-4767-5fg3
LiteLLM: M2M JWT Handler Has Improper Authorization
High Same weakness, CWE-266
GHSA-6qr3-3g89-m4jj
LiteLLM: Admin Key Handler Has Improper Authorization
High Same weakness, CWE-266
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor