What is CVE-2026-48172?
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
Timeline
- 2026-05-21Published to the U.S. National Vulnerability Database (NVD)
- 2026-05-24First covered in a defend.network daily briefing
- 2026-05-26Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
- 2026-05-29CISA federal remediation deadline (BOD 22-01)
- 2026-07-23NVD record last updated
CISA Known Exploited Vulnerability
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
Affected product
LiteSpeed CPanel Plugin
NVD also lists CPE entries for: Litespeedtech Litespeed Cpanel Plugin, Litespeedtech Litespeed Whm Plugin
Remediation Steps
- Apply the latest security patch from LiteSpeed for the cPanel Plugin immediately
- Verify that only authorized cPanel users have access to affected systems
- Review system logs for evidence of exploitation or unauthorized script execution
- Restrict cPanel administrative access to trusted networks where feasible
References
- https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log
- https://nvd.nist.gov/vuln/detail/CVE-2026-48172
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 4 of June 2026 (June 22 – 28)
- Vulnerability Priority Report – Week 3 of June 2026 (June 15 – 21)
- Vulnerability Priority Report – Week 2 of June 2026 (June 8 – 14)
- Vulnerability Priority Report – Week 1 of June 2026 (June 1 – 7)
- Vulnerability Priority Report – Week 22 of May 2026 (May 25 – 31)
- GitHub npm supply chain attacks, LiteSpeed RCE, CISA credentials exposed (2026-05-25)
- GitHub, npm, and Drupal under attack: supply-chain threats and active CVE exploitation (2026-05-24)
Browse all tracked CVEs in the defend.network CVE database →