Critical LiteSpeed Flaw Allows Root Access via Shared Hosting Accounts

• •A critical vulnerability in LiteSpeed Web Server Enterprise allows root access to shared hosting accounts.
• •Affected versions include those prior to 6.3.7; administrators are urged to update immediately.
• •This is the third instance of privilege escalation vulnerabilities in LiteSpeed software since May 2026.

A critical vulnerability in LiteSpeed Web Server Enterprise allows low-privilege users on shared-hosting servers to gain root access. This flaw can bypass account isolation controls like CageFS, enabling attackers to access or alter other hosted websites. Affected versions are those prior to 6.3.7, with the patch released on September 11, 2026. cPanel issued an advisory on September 14, urging administrators to update immediately. The advisory does not provide a CVE identifier or indicate whether the flaw has been exploited. This vulnerability marks the third instance since May where LiteSpeed software has allowed root access through cPanel servers. Previous vulnerabilities, CVE-2026-48172 and CVE-2026-54420, were also linked to privilege escalation and confirmed to be actively exploited. As of September 15, 2026, LiteSpeed's download page still lists the previous stable version, 6.3.6.