News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a serious vulnerability affecting the LiteSpeed cPanel Plugin in its Known Exploited Vulnerabilities (KEV) list. Federal Civilian Executive Branch (FCEB) organizations are required to remediate the issue by June 18, 2026.

The weakness is tracked as CVE-2026-54420 and carries a CVSS score of 8.5. It is classified as a privilege-escalation bug that can be leveraged by an account with FTP or web shell access to obtain root privileges on shared hosting environments that use CloudLinux or CageFS.

The problem stems from improper handling of user-supplied symbolic links in the LiteSpeed cPanel plugin versions before 2.4.8 (and as shipped in the LiteSpeed WHM PlugIn versions prior to 5.3.2.0). This flaw can be abused on multi-tenant servers to escalate from a restricted user to a full root account.

At this time there is no public, confirmed information indicating active exploitation in the wild or whether any such attempts succeeded. LiteSpeed has provided a log-search command administrators can run to determine if their systems show signs of activity related to the issue:

grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null

If that grep produces no output, LiteSpeed says the server is very likely not affected.

If results are returned, the vendor suggests checking for two additional indicators to avoid false positives:

• the API call generateEcCert appearing immediately followed by packageUserSize for the same account (a sequence not performed by legitimate UI flows);
• attempts that show roughly 7-10 concurrent calls (the normal UI issues a single call at a time).

LiteSpeed credits Namecheap with reporting the issue on May 31, 2026. To mitigate the vulnerability, administrators should update to LiteSpeed WHM Plugin version 5.3.2.1 or later – this release includes the cPanel plugin updated to v2.4.8 – or install any newer versions that have been released.

Organizations running shared hosting with CloudLinux or CageFS, and anyone relying on LiteSpeed’s cPanel/WHM components, should prioritize applying the patch and using the provided detection steps to confirm their systems are clean.