Skip to content

CVE-2026-48172

CVE

Threat entity extracted from intelligence sources

Frequency
5
occurrences
First Seen
May 23, 2026
Last Seen
September 15, 2026
API
Exploited in Wild
—
Ransomware Use
—
Public Exploits
—
Attack Vector
—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Zero-Day Vulnerability in LiteSpeed cPanel Plugin Actively Exploited86.0

A critical zero-day privilege escalation vulnerability in the LiteSpeed User-End cPanel plugin is being exploited in the wild, allowing authenticated cPanel users to execute arbitrary scripts as root. This flaw, tracked as CVE-2026-48172, has a maximum CVSS score of 10.0 and affects versions from v2...

CISA Issues Urgent Warning on Actively Exploited LiteSpeed cPanel Plugin Vulnerability72.9

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a critical vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin, which allows attackers with FTP or web shell access to escalate privileges to root on shared hosting servers using CloudL...

Critical LiteSpeed Web Server Vulnerability Allows Root Access via Shared Hosting Accounts71.3

A critical vulnerability in LiteSpeed Web Server Enterprise allows low-privilege users on shared hosting servers to gain root access, potentially compromising other accounts and the server itself. The flaw affects versions prior to 6.3.7, and cPanel issued an advisory on September 14, 2026, urging i...

Public Exploits

Checking GitHub for proof-of-concept code…

CVE Details

Related Entities

Zero-day ExploitData BreachLiteSpeedCloudLinuxCybersecurity and Infrastructure Security AgencyNamecheapCVE-2026-54420CWE-269 - Improper Privilege ManagementCWE-22 - Path TraversalCWE-287 - Improper AuthenticationGovernmentT1068 - Exploitation for Privilege Escalation