- Critical 10.0
- Known exploited (CISA KEV)
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The iss…
Scores
The facts
- Published
- 21 May 2026
- Last changed
- 7 October 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 10.0 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- litespeedtech litespeed cpanel plugin
- litespeedtech litespeed whm plugin
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 26 May 2026.
- EPSS
- 1.0% chance of exploitation activity in the next 30 days (percentile 63).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.