CISA Flags Lite Speed cPanel Plugin Flaw Exploited for Root Privilege Escalation
Summary: CISA added CVE-2026-54420, a privilege escalation flaw in the LiteSpeed cPanel Plugin rated CVSS 8.5, to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply fixes by June 18, 2026. The bug lets a user with FTP or web shell access escalate to root on shared hosting servers running CloudLinux or CageFS, and LiteSpeed says the plugin before 2.4.8 mishandles symlinks provided by such a user.
What you should know: The flaw turns FTP or web shell access into root on shared hosting servers, so one compromised low-privilege account can reach every tenant on the box. Namecheap brought the issue to LiteSpeed's attention on May 31, 2026, and CISA's KEV listing means the exploitation window is already open.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-54420
- Related
- CVE-2026-54420: Lite Speed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability Known Exploited Vulnerabilities · Jun 15, 2026