Back Feeds.4Sysops

CISA warns of LiteSpeed cPanel plugin flaw allowing root access

Feeds.4Sysops •IT News • June 16, 2026

A critical privilege escalation vulnerability in the LiteSpeed cPanel plugin is now being exploited in the wild, prompting a warning from CISA. The flaw, tracked as CVE-2026-54420, allows attackers with basic FTP or web shell access to gain full root privileges on shared hosting environments. This security hole specifically affects servers running CloudLinux or CageFS due to the improper handling of user-provided symlinks. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Issues Urgent Warning on Actively Exploited LiteSpeed cPanel Plugin Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin, which allows attackers with FTP or web shell access to escalate privileges to root on shared hosting servers using CloudLinux/CageFS. This vulnerability, reported by Namecheap, is actively being exploited, prompting CISA to mandate that federal agencies secure their systems within three days. The flaw affects all versions prior to 2.4.8 of the plugin, which has been patched in the latest release. Users are advised to run specific commands to check for exploitation and examine system logs for any suspicious activity. The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on June 15, 2026, following its public disclosure on June 14, 2026. This situation highlights the ongoing risks associated with privilege escalation vulnerabilities in widely used software. 5 sources 73

Extracted Entities

CISA warns of LiteSpeed cPanel plugin flaw allowing root access

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (2)