The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity LiteSpeed cPanel Plugin vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-54420, is being actively exploited and could allow attackers to gain root-level privileges on vulnerable hosting servers.

What Is CVE-2026-54420?

CVE-2026-54420 is a privilege escalation vulnerability affecting LiteSpeed cPanel Plugin versions earlier than 2.4.8 and LiteSpeed WHM Plugin versions earlier than 5.3.2.0. The issue stems from improper handling of symbolic links (symlinks) in shared hosting environments running CloudLinux or CageFS. (NVD)

According to security advisories, an attacker with existing FTP or web shell access can exploit the flaw to bypass security restrictions and potentially gain root access to the server.

Why This Vulnerability Matters

Root-level access gives attackers complete control over a system. Once compromised, a threat actor may be able to:

• Execute administrative commands
• Access sensitive customer data
• Install malware or backdoors
• Modify or delete critical files
• Take over shared hosting infrastructure

Because many web hosting providers use LiteSpeed and cPanel, the impact could extend to multiple customer accounts hosted on the same server.

Affected Versions

The vulnerability affects:

• LiteSpeed cPanel Plugin before version 2.4.8
• LiteSpeed WHM Plugin before version 5.3.2.0

LiteSpeed has already released patched versions that address the issue.

What Administrators Should Do

Organizations using LiteSpeed cPanel Plugin should prioritize patching immediately. CISA has classified the flaw as actively exploited, making remediation urgent. (Navanem)

Recommended actions include:

• Upgrade to the latest LiteSpeed plugin versions
• Review server logs for suspicious activity
• Investigate indicators of compromise
• Restrict unnecessary FTP and shell access
• Maintain regular security patching procedures

Conclusion

The addition of CVE-2026-54420 to CISA’s KEV catalog highlights the seriousness of this vulnerability. Since attackers are already exploiting the flaw in real-world environments, administrators running LiteSpeed cPanel Plugin should apply security updates as soon as possible to prevent privilege escalation and potential server compromise.

Source: https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html