← Back to Vulnerability Reports CVE Intelligence

CVE-2026-54420

LiteSpeed CPanel Plugin•HIGH · CVSS 8.5• In the wild In CISA KEV

What is CVE-2026-54420?

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

CVSS8.5 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS1% · P73

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWECWE-61

NVD published2026-06-14

NVD last modified2026-07-23

Timeline

2026-06-14Published to the U.S. National Vulnerability Database (NVD)
2026-06-15Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-06-18CISA federal remediation deadline (BOD 22-01)
2026-07-23NVD record last updated

CISA Known Exploited Vulnerability

LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

Added to KEV2026-06-15

Federal patch deadline2026-06-18

Known ransomware useUnknown

Affected product

LiteSpeed CPanel Plugin

NVD also lists CPE entries for: Litespeedtech Litespeed Cpanel Plugin, Litespeedtech Litespeed Whm Plugin

Remediation Steps

Apply the patch for the LiteSpeed cPanel user-end plugin to all cPanel servers
Test patched plugin functionality in a staging environment before production deployment
Review server logs for evidence of exploitation attempts
Notify hosting customers of patch deployment timeline

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of July 2026 (July 13 – 19)
Vulnerability Priority Report – Week 1 of July 2026 (July 6 – 12)
Vulnerability Priority Report – Week 5 of June 2026 (June 29 – July 5)
Vulnerability Priority Report – Week 4 of June 2026 (June 22 – 28)
Vulnerability Priority Report – Week 3 of June 2026 (June 15 – 21)

Related vulnerabilities

CVE-2026-48172 – LiteSpeed CPanel Plugin (same product)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.