Lite Speed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
Summary: cPanel warned on September 14 that a critical flaw in LiteSpeed Web Server Enterprise, affecting versions before 6.3.7, could let a low-privilege website user on a shared-hosting server gain root access and reach other customers' sites and the server itself. The flaw bypasses account isolation controls including CloudLinux's CageFS, carries no CVE identifier or severity score, and neither cPanel nor LiteSpeed has described how it works or said whether it has been exploited.
Key Takeaway: This is the third LiteSpeed flaw since May reported to give a hosting account root on cPanel servers, and the first in the web server itself, after CVE-2026-48172 and CVE-2026-54420 were both actively exploited and added to CISA's KEV catalog. The fix may not arrive on its own, since LiteSpeed said auto-update may be delayed and its download page still listed 6.3.6 as stable on September 15.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-48172CVE-2026-54420
- Related
- Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server Cyber Risks ·CVE-2026-54420: Lite Speed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability Known Exploited Vulnerabilities · Jun 15, 2026CVE-2026-48172: Lite Speed cPanel Plugin Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 26, 2026