CVE-2026-48172
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
Description
CVE-2026-48172 is a critical-severity privilege escalation vulnerability in the LiteSpeed User-End cPanel Plugin caused by incorrect privilege assignment. The flaw is exposed through the user-end cPanel plugin and can be abused by any cPanel user account to execute arbitrary scripts with root privileges, effectively granting full control of the underlying server. With a maximum CVSS score of 9.8 and confirmed exploitation in the wild in May 2026, CVE-2026-48172 was added to the CISA Known Exploited Vulnerabilities catalog with a short remediation deadline. Any shared-hosting environment running an unpatched LiteSpeed cPanel Plugin is at immediate risk, because the privilege escalation lets a single low-privileged tenant compromise the entire host.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| litespeedtech | litespeed cpanel plugin | < 2.4.7 |
| litespeedtech | litespeed whm plugin | < 5.3.1.0 |
References
- https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/(Vendor Advisory)
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel(Product)
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48172(US Government Resource)
Weakness Type
CWE-266: Incorrect Privilege Assignment
In the LiteSpeed cPanel Plugin, incorrect privilege assignment allows a user-facing feature — the Redis enable/disable functionality — to perform actions with root privileges that should be restricted to administrators. Because the plugin grants more privilege than the cPanel user role warrants, any cPanel account can invoke the affected code path and execute arbitrary scripts as root.
Learn more: CWE-266 — Incorrect Privilege Assignment
Impact Analysis
CVE-2026-48172 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting an almost worst-case exploitability and impact profile. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, and fully compromises the confidentiality, integrity, and availability of the affected host because exploitation yields root-level code execution. In multi-tenant shared-hosting environments — the primary deployment for the LiteSpeed cPanel Plugin — this means a single cPanel customer can pivot from their own account to total control of the server and every other tenant on it. Although the EPSS score is currently low at 0.01% (2.7th percentile), CISA has confirmed active exploitation in the wild in May 2026, so the KEV listing — not the EPSS estimate — is the signal that should drive urgency here.
Exploit Maturity
CVE-2026-48172 is being actively exploited: the NVD and CISA both confirm exploitation in the wild in May 2026, and LiteSpeed has published a security advisory (LiteSpeed blog). No tagged public proof-of-concept appears in the NVD references yet, and the EPSS score of 0.01% does not yet reflect the observed attacks, but the presence on the CISA KEV catalog means weaponized exploitation is already occurring against internet-facing hosts. LiteSpeed provides a detection one-liner — grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ — so administrators should treat any matching log output as a potential compromise indicator and act now rather than wait for the EPSS score to catch up.
Remediation
- Apply updates immediately or discontinue use as mandated by the CISA KEV deadline of 2026-05-29: upgrade the LiteSpeed User-End cPanel Plugin to the recommended minimum version 2.4.7 (the fix first landed in 2.4.5), and upgrade the LiteSpeed WHM Plugin to 5.3.1.0 or later.
- Run the vendor-supplied detection command
grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null. If it returns output, examine the listed IP addresses, block any that are not legitimate, and correlate their activity with system logs to scope the damage. - Until the patch is applied, restrict access to the cPanel/WHM interface (IP allowlisting, VPN-only access) to reduce the pool of accounts that can reach the vulnerable Redis enable/disable feature.
- Because exploitation grants root, treat any confirmed hit as a full server compromise: review for unauthorized cron jobs, new SUID binaries, modified web content, and persistence mechanisms across all tenant accounts.
- As long-term hardening against incorrect privilege assignment, audit cPanel plugins for code paths that escalate to root on behalf of unprivileged users, and apply the principle of least privilege so user-facing features never execute with administrative rights.
Technical Details
CVE-2026-48172 stems from incorrect privilege assignment (CWE-266) in the LiteSpeed User-End cPanel Plugin before 2.4.5, where the Redis enable/disable feature is reachable from the user-end plugin and runs with root privileges. The NVD notes the issue is related to mishandling of the Redis enable/disable features, allowing a cPanel user to invoke the redisAble JSON-API function and have arbitrary scripts executed as root. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the severity: the path is network-reachable, requires no special conditions, demands no authentication beyond standard cPanel access, and results in complete compromise of the host. Because the affected privilege boundary sits between the cPanel tenant role and the root account, the impact is escalation from any user account to the highest level of system control.
Frequently Asked Questions
Is CVE-2026-48172 being actively exploited?
Yes. Both NVD and CISA confirm CVE-2026-48172 was exploited in the wild in May 2026, which is why it was added to the CISA Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-05-29. The EPSS score of 0.01% lags behind the observed activity, so the KEV listing should drive your response timeline.
What products are affected by CVE-2026-48172?
The vulnerability affects the LiteSpeed User-End cPanel Plugin before version 2.4.5 (recommended minimum 2.4.7) and the LiteSpeed WHM Plugin before 5.3.1.0. Shared-hosting servers running cPanel with these LiteSpeed plugins are the primary exposure.
How do I fix CVE-2026-48172?
Upgrade the LiteSpeed cPanel Plugin to at least version 2.4.7 and the WHM Plugin to 5.3.1.0 per the vendor security advisory. Then run the vendor detection command to check your logs for prior exploitation, and if hits are found, treat the host as compromised and perform incident response.
How severe is CVE-2026-48172?
CVE-2026-48172 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allows any cPanel user to execute arbitrary scripts as root with no authentication barrier beyond normal account access, leading to complete compromise of the host and, in shared-hosting setups, every tenant on it.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.