CISA on Tuesday urged federal agencies to immediately patch a critical-severity vulnerability in the LiteSpeed user-end plugin for cPanel that has been exploited in the wild.
Tracked as CVE-2026-48172 (CVSS score of 9.8), the flaw is described as a privilege escalation issue that could allow attackers to execute arbitrary scripts with root privileges.
LiteSpeed resolved the security defect last week in version 2.4.5 of the user-end plugin, noting that it had been exploited in the wild as a zero-day. LiteSpeed’s WHM plugin is not affected, it said.
“This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions between v2.3 and v2.4.4,” LiteSpeed warned.
It also provided users with instructions on how to check if their servers have been affected, recommending immediate action if potential exploitation has been identified.
“We recommend you examine the IPs in the list, determine if they are valid, and if not, block them. To determine any damage done, examine the system logs for any actions taken by the detected IPs,” LiteSpeed said.
Users should upgrade to LiteSpeed WHM Plugin version 5.3.1.0 (bundled with the user-end plugin version 2.4.7) or higher, which contain patches for the vulnerability. If patching is not possible, users are advised to completely remove the plugin.
On May 19, cPanel pushed a nightly update that removed the LiteSpeed user-end plugin for all cPanel versions, underlining that the exploited CVE allowed unauthorized root access to the server.
On Tuesday, CISA added CVE-2026-48172 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it or remove the vulnerable plugin versions by May 29, in line with Binding Operational Directive (BOD) 22-01 guidance.
Related: Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment
Related: Ghost CMS Vulnerability Exploited to Hack Over 700 Websites
Related: Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector
Related: Over 40,000 Servers Compromised in Ongoing cPanel Exploitation
