CYBERSECURITYMay 23, 20261 min read24 views

LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root

A maximum-severity security vulnerability (CVSS 10.0) impacting the LiteSpeed User-End cPanel Plugin is under active exploitation, allowing attackers to execute arbitrary scripts with elevated root privileges.

A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild.

The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to run arbitrary scripts with elevated permissions.

"Any cPanel user (including an attacker or a compromised account) may exploit the lsws.redisAble function to execute arbitrary scripts as root," LiteSpeed said.

The vulnerability impacts all versions of the plugin between 2.3 and 2.4.4. LiteSpeed's WHM plugin is not impacted. The issue has been addressed in version 2.4.5. Security researcher David Strydom has been credited with discovering and reporting the flaw.

LiteSpeed noted that the "vulnerability is being actively exploited," but refrained from sharing additional details. It has provided the following indicator of compromise -

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

If running the aforementioned "grep" command does not produce any output, the server is not affected. However, if there is any output, users are advised to examine the IP addresses in the list and determine if they are legitimate, and if not, block them.

Following a security review of its cPanel and WHM plugins in the wake of the vulnerability, LiteSpeed said it has patched additional potential attack vectors in both plugins and released cPanel plugin version 2.4.7 as part of WHM plugin version 5.3.1.0.

Users are advised to upgrade to LiteSpeed WHM Plugin version 5.3.1.0, which is bundled with cPanel plugin v2.4.7 or higher, to patch the vulnerability. If immediate patching is not an option, it's recommended to remove the user-end plugin by running the below command -

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall

The development comes weeks after a critical cPanel vulnerability (CVE-2026-41940, CVSS score: 9.8) was identified as actively exploited by unknown threat actors to deploy Mirai botnet variants and a ransomware strain called Sorry.

Source: The Hacker News

More in this category

cybersecurity

SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough.

Traditional SASE architectures are struggling to keep up with the shift to browser-based workflows and generative AI, as modern encryption and decentralized data interactions render packet inspection obsolete.

cybersecurity

Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns

Cybersecurity researchers have uncovered a series of cyber espionage campaigns targeting Pakistani law enforcement agencies, with suspected Chinese and Indian threat actors weaponizing a police portal to deploy malware.

cybersecurity

Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking

Researchers ran 281 of the most popular free VPN apps on the Google Play Store through a new testing system and found that many fail at the basics people install a VPN for, i.e., keeping their traffic private and secure.

cybersecurity

npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk

GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA).

cybersecurity

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

Ubiquiti has shipped updates to address multiple critical security flaws impacting UniFi Connect, UniFi Talk, UniFi Access, UniFi Protect, and UniFi OS that could result in privilege escalation and arbitrary command execution.

cybersecurity

DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A new Microsoft 365 device code phishing campaign leveraging the DEBULL tooling has been observed bypassing MFA to hijack victim accounts. This activity highlights a growing trend of Phishing-as-a-Service (PhaaS) platforms adopting legitimate OAuth 2.0 authentication flows for post-compromise operations.