Critical Zero-Day Vulnerability in LiteSpeed cPanel Plugin Actively Exploited

Thehackernews

Critical Zero-Day Vulnerability in LiteSpeed cPanel Plugin Actively Exploited

First seen 23 May 2026, 10:55 UTC • •86.0

Article Content

1 / 18

Browse articles

ThreatCluster •May 24, 2026 at 10:33 UTC

•CVE-2026-48172 is a critical zero-day vulnerability with a CVSS score of 10.0.
•The vulnerability allows authenticated users to execute scripts as root, compromising server control.
•A patch was released on May 21, 2026, but active exploitation is ongoing.

A critical zero-day privilege escalation vulnerability in the LiteSpeed User-End cPanel plugin is being exploited in the wild, allowing authenticated cPanel users to execute arbitrary scripts as root. This flaw, tracked as CVE-2026-48172, has a maximum CVSS score of 10.0 and affects versions from v2.3 to below v2.4.5. The vulnerability was disclosed and patched on May 21, 2026, but active exploitation has been reported. Server administrators are urged to update their systems immediately to mitigate risks. The flaw enables full server control for attackers, posing a significant threat to Linux hosting environments. The situation remains critical as attackers may still be leveraging the unpatched versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 146d ago How this analysis works

Timeline

2026-05-21

CVE-2026-48172 published

LiteSpeed disclosed a critical privilege escalation vulnerability in its cPanel plugin, affecting versions from v2.3 to below v2.4.5.

2026-05-21

Patch released

LiteSpeed released a patch for the critical vulnerability, urging users to update their systems immediately.

Cybersecuritynews

Recent

Active exploitation reported

Reports indicate that the vulnerability is being actively exploited to gain root access on Linux hosting servers.

More articles in this cluster (17)

Threat Graph

7 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Organization (1)

LiteSpeed

Vulnerability (1)

CVE-2026-48172

Weakness (1)

CWE-269 - Improper Privilege Management

Affected Platform (2)

cPanel
Linux

Relationships

CVE-2026-48172 targets cPanel
CVE-2026-48172 targets Linux
Zero-day Exploit targets cPanel
Zero-day Exploit targets Linux
T1068 - Exploitation for Privilege Escalation targets cPanel
T1068 - Exploitation for Privilege Escalation targets Linux
CVE-2026-48172 related to LiteSpeed
CVE-2026-48172 related to CWE-269 - Improper Privilege Management

Following this threat?

Track LiteSpeed and CVE-2026-48172 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…