LiteSpeed cPanel Plugin Privilege Escalation Exploited
NEOSEC enrichment — no mirror of the original source
On May 19, 2026, LiteSpeed issued a security update for a critical flaw in the user-end cPanel plugin between v2.3 and v2.4.4, known at the time of disclosure to have already been actively exploited as a zero-day. CVE-2026-48172, CVSS score
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at SANS NewsBitesLinked advisories
Affected vendors and products
More on LiteSpeed
Other advisories
- HighCVE-2026-119559LiteSpeed Technologies OpenLiteSpeed: unzureichende Zertifikatvalidierung
- HighCVE-2026-119559LiteSpeed Technologies OpenLiteSpeed: unzureichende Zertifikatvalidierung
- Not ratedosv:CVE-2026-119559OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
- MediumCVE-2026-116763LiteSpeed Cache: Cross-Site-Scripting (XSS)
- MediumCVE-2026-109215LiteSpeed Cache: Cross-Site-Scripting (XSS)
- MediumCVE-2026-116763LiteSpeed Cache: Cross-Site-Scripting (XSS)
- MediumCVE-2026-109215LiteSpeed Cache: Cross-Site-Scripting (XSS)
- Not ratedosv:CVE-2026-109215LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
Other news entries
- LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared ServerNewsThe Hacker News
- Joomla, LiteSpeed Vulnerabilities Exploited in AttacksNewsSecurityWeek
- CISA warns of another cPanel plugin flaw exploited in attacksNewsBleepingComputer
- CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege EscalationNewsThe Hacker News
- Recent KEV Additions: LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager, and Splunk EnterpriseVulnerabilitySANS NewsBites
- CISA gives feds 4 days to patch actively exploited cPanel plugin flawNewsBleepingComputer
- LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as RootNewsThe Hacker News
- Root-Attacken auf Cisco Catalyst SD-WAN Manager und cPanel-Plug-in LiteSpeedNewsheise Security
Source: https://blog.litespeedtech.com/
ID