CVE-2026-54420Active Exploitation(litespeedtech / litespeed_cpanel_plugin)

HIGHCVSS 8.5 · HIGHCISA KEV

Exploitation observed; activity peaked at 25 mentions and remains active

Immediate actions

Patch litespeedtech litespeed_cpanel_plugin systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

litespeedtech CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-18. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/

Other references

Weakness type (CWE)

CWE-61

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

litespeed_cpanel_plugin
litespeed_whm_plugin

Threat summary

Active exploitation appears in 34 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
45 mentions across 10 observed days

What's happening

Active exploitation reported across 34 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 22 signals
Technical details provided in 32 signals
Disclosure: 4 classified signals
Peaked 7d ago at 25 mentions (2026-06-16); latest day: 1
45 total mentions across 10 days

Affected systems

Vendors

litespeedtech

Products

litespeed_cpanel_pluginlitespeed_whm_plugin

Deep dive

Activity timeline45 mentions / 10d

Signal classification5 categories

Active Exploitation

3168.9%

Patch

613.3%

Disclosure

48.9%

General

36.7%

PoC

12.2%

Referenced assets34 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-14	4	Active Exploitation2Disclosure1General1
2026-06-15	4	Active Exploitation2Patch2
2026-06-16	25	Active Exploitation18Disclosure1General2Patch3PoC1
2026-06-17	2	Active Exploitation1Patch1
2026-06-18	2	Active Exploitation1Disclosure1
2026-06-19	3	Active Exploitation3
2026-06-24	1	Active Exploitation1
2026-07-10	2	Active Exploitation2
2026-07-12	1	Disclosure1
2026-08-16	1	Active Exploitation1

Full discourse20 posts

The Hacker News@TheHackersNews134d
Active Exploitation
🚨 A shared hosting flaw just landed on CISA’s exploited list. CVE-2026-54420 affects the LiteSpeed cPanel Plugin and can let a user with FTP or web shell access gain root on CloudLinux/CageFS servers. Federal agencies must patch by June 18, 2026. Read: https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html https://t.co/G7GZjG2BwE
Post summary
CVE‑2026‑54420 is on CISA’s exploited list, indicating active exploitation risk; federal agencies are required to patch by June 18, 2026.
4221721320.7K
2.2M followersView on X
CISA Cyber@CISACyber135d
Active Exploitation
🛡️ We added Cisco Catalyst SD-WAN Manager vulnerability CVE-2026-20262 and LiteSpeed cPanel Plugin vulnerability CVE-2026-54420 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity https://t.co/rAEee4kpx6
Post summary
The tweet lists two CVEs added to a known exploited vulnerabilities catalog, indicating they are actively being exploited, but no PoC, exploit code, or specific patch details are shared.
11503345.6K
301.2K followersView on X
Dark Web Informer@DarkWebInformer136d
Active Exploitation
‼️ CVE-2026-54420: LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026. CVSS: 8.5 https://nvd.nist.gov/vuln/detail/CVE-2026-54420
Post summary
CVE-2026-54420 involves a high‑severity vulnerability in LiteSpeed cPanel plugins that mishandles symlinks, and it was actively exploited in the wild in May 2026.
27030138.1K
226.8K followersView on X
elhacker.NET@elhackernet134d
Active Exploitation
Vulnerabilidad crítica de día cero (CVE-2026-54420) en el complemento de usuario de LiteSpeed cPanel que está siendo explotada activamente https://blog.elhacker.net/2026/06/explotan-vulnerabilidad-0-day-en-plugin.html
Post summary
The text reports that CVE-2026-54420, a critical zero‑day in LiteSpeed cPanel’s user plugin, is being actively exploited in the wild, but it does not provide a PoC, exploit code, patch, or technical details.
0701372.3K
141.3K followersView on X
NooshDaroo | نوشدارو@NooshDaroo_web133d
Patch
آسیب‌پذیری در پلاگین لایت‌اسپید برای سی‌پنل؛ نسخه ۲.۴.۸ را فوراً نصب کنید سازندگان لایت‌اسپید (LiteSpeed) برای پلاگینِ سمتِ کاربرِ «سی‌پنل» یک وصله امنیتی اضطراری منتشر کرده‌اند که نقص امنیتی مهمی با شناسه CVE-2026-54420 را برطرف می‌کند. گفته می‌شود نسخه‌های پیش از ۲.۴.۸ آسیب‌پذیر هستند و مدیران سرورها باید فوراً این به‌روزرسانی مهم را دریافت کنند. این نقص که از ابتدای خردادماه مورد بهره‌برداری قرار گرفته، روی سرورهای اشتراکی مبتنی بر CloudLinux/CageFS به افزایش سطح دسترسی تا Root منجر می‌شود. حتی آژانس امنیت سایبری و زیرساخت ایالات متحده هم این ضعف را جزو آسیب‌پذیری‌های نیازمند توجه فوری دسته‌بندی کرده است. به گفته لایت‌اسپید، این آسیب‌پذیری در پلاگین سمت کاربر سی‌پنل وجود دارد و ماژول WHM plugin را تحت تأثیر قرار نمی‌دهد. لایت‌اسپید توصیه می‌کند کاربران LiteSpeed WHM Plugin را به نسخه‌ی v5.3.2.1 یا بالاتر ارتقا دهند، زیرا این نسخه، cPanel plugin v2.4.8 را نیز در خود دارد. همچنین، لایت‌اسپید برای بررسی سوءاستفاده‌های احتمالی روی سرور، استفاده از این دستور را پیشنهاد کرده است: grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/null اگر این دستور خروجی ندهد، لایت‌اسپید می‌گوید در آن لاگ‌ها نشانه‌ای از سوءاستفاده دیده نشده است. اگر خروجی تولید شود، احتمال دارد از آسیب‌پذیری روی سرور شما بهره‌برداری شده باشد. با این حال، خود شرکت هشدار می‌دهد که این دستور همیشه نتیجه قطعی نمی‌دهد و ممکن است در برخی موارد، آلودگی وجود داشته باشد اما در لاگ‌ها دیده نشود. برای اطمینان بیشتر، مدیر سایت باید الگوی فراخوانی‌ها و آی‌پی‌های مبدأ را دقیق‌تر بررسی کند. به گفته لایت‌اسپید، اگر فعلاً امکان ارتقا ندارید، می‌توانید پلاگین کاربری را موقتاً حذف کنید تا از این مسیر آسیب‌پذیری دور بمانید. پس از به‌روزرسانی هم می‌توانید پلاگین را دوباره نصب و حالت به‌روزرسانی خودکار را فعال کنید. ✍️ هوشیار ذوالفقارنسب #خبر_و_تحلیل #کسب_و_کار_آنلاین
Post summary
The post announces the CVE‑2026‑54420 vulnerability in LiteSpeed’s cPanel plugin, highlights that it has already been exploited in the wild, and urges immediate patching to version 2.4.8 or a temporary removal as mitigation.
0002041.2K
7.8K followersView on X
Daily CyberSecurity@the_yellow_fall134d
Active Exploitation
CVE-2026-54420, a LiteSpeed cPanel privilege escalation flaw, is exploited in the wild to gain root on shared hosting. Patch to plugin v2.4.8 now. #LiteSpeed #cPanel #CVE202654420 #PrivilegeEscalation #InfoSec https://securityonline.info/litespeed-cpanel-privilege-escalation-cve-2026-54420 https://t.co/7zHLiwvUk9
Post summary
CVE‑2026‑54420 is a privilege‑escalation flaw in LiteSpeed cPanel that is actively exploited in the wild; a patch for the plugin (v2.4.8) is now available.
020122623
12.8K followersView on X
piyokango@piyokango134d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/15追加） 🛡 CVE-2026-20262 Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability ==================================== ✅概要・深刻度：注意 6.5 (CVSS Base) / Cisco (CNA) ・種別：パス・トラバーサル (CWE-22) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Cisco Catalyst SD-WAN Manager の Web UI に存在する脆弱性です。ファイルアップロード処理におけるユーザー入力の検証不備により、認証済みのリモート攻撃者が影響を受けるシステム上にファイルを作成、または任意のファイルを上書きできる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：中 ✅CISA 評価・攻撃自動化：自動化は困難・技術的影響：部分的制御 ✅攻撃前提条件・Cisco Catalyst SD-WAN Manager を使用している・影響を受けるバージョンを使用している・攻撃者が低権限の認証情報を持っている・攻撃者が対象の Web UI へネットワーク経由でアクセスできる・修正済みソフトウェアへ更新されていない ✅悪用時影響・影響を受けるシステム上にファイルを作成される可能性がある・影響を受けるシステム上の任意ファイルを上書きされる可能性がある・システム上のファイル改ざんにつながる可能性がある・後続の権限昇格に利用される可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：未確認 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-20262 ・https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ 🛡CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability ==================================== ✅概要・深刻度：重要 8.5 (CVSS Base) / MITRE (CNA) ・種別：UNIX Symbolic Link のフォロー (CWE-61) ・CVSS:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H LiteSpeed cPanel plugin 2.4.8 未満、および LiteSpeed WHM PlugIn 5.3.2.0 未満に同梱される cPanel plugin に存在する脆弱性です。 CloudLinux/CageFS を使用する共有ホスティングサーバー上で、FTP または Web shell アクセスを持つユーザーが提供したシンボリックリンクの処理が不適切です。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：中 ✅CISA 評価・SSVC 悪用の状況：悪用確認済・攻撃自動化：自動化は困難・技術的影響：完全制御 ✅攻撃前提条件・LiteSpeed cPanel plugin 2.4.8 未満、または LiteSpeed WHM PlugIn 5.3.2.0 未満に同梱される cPanel plugin を使用している・共有ホスティングサーバーで CloudLinux/CageFS を使用している・攻撃者が FTP または Web shell アクセスを持っている・攻撃者がシンボリックリンクを配置できる・修正済みバージョンまたは回避策が適用されていない ✅悪用時影響・共有ホスティングサーバー上で root 権限へ昇格される可能性がある・CloudLinux/CageFS による隔離を回避される可能性がある・本来アクセス権のないファイルにアクセスまたは変更される可能性がある・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（LiteSpeed） LiteSpeed は、脆弱性が積極的に悪用されていると報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-54420 ・https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ ・https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel https://www.cisa.gov/news-events/alerts/2026/06/15/cisa-adds-two-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
The post announces two CVEs, noting that CVE-2026-54420 is actively exploited while CVE-2026-20262 has no exploitation evidence, and it provides severity details, official advisory links, and patch information.
000714.1K
44.1K followersView on X
Threat Intelligence@threatintel131d
Active Exploitation
#ThreatProtection #CVE-2026-54420 - #LiteSpeed cPanel Plugin #vulnerability exploited in the wild, read more about Symantec's protection: https://www.broadcom.com/support/security-center/protection-bulletin/cve-2026-54420-litespeed-cpanel-plugin-vulnerability
Post summary
The post indicates that CVE‑2026‑54420 is being actively exploited in the wild against LiteSpeed cPanel Plugin, and references Symantec’s protection bulletin. No specific technical details, PoC, or mitigation steps are provided.
010311.3K
115.2K followersView on X
Andre Gironda@AndreGironda134d
PoC
CVE-2026-54420 LiteSpeed cPanel Plugin Symlink Privilege Escalation POC -- https://github.com/HORKimhab/CVE-2026-54420
Post summary
The message announces a PoC for the LiteSpeed cPanel plugin privilege‑escalation vulnerability CVE‑2026‑54420, with exploit code available on GitHub, but provides no evidence of active exploitation or vendor remediation.
02021506
3.8K followersView on X
yousukezan@yousukezan134d
Active Exploitation
LiteSpeedのcPanelプラグインに存在する権限昇格の脆弱性CVE-2026-54420が実際に悪用されていることが明らかになった。攻撃者は共有ホスティング環境で低権限ユーザーからroot権限を取得できる可能性がある。この脆弱性はLiteSpeed cPanel Plugin 2.4.8未満に存在する。NVDによると、CloudLinuxおよびCageFS環境で、FTPアクセスやWebシェルを持つユーザーが細工したシンボリックリンクを利用することで権限昇格が可能になる。 CVSSスコアは8.5で、Namecheapのチームが報告した。LiteSpeedも、この問題が2026年5月時点で実際に悪用されていると警告している。共有ホスティング環境では複数の利用者が同一サーバーを利用するため、1つのアカウントが侵害されるとサーバー全体へ影響が及ぶ可能性がある。 LiteSpeedはcPanel Plugin v2.4.8およびWHM Plugin v5.3.2.1で問題を修正した。修正前のバージョンでは、同一IPアドレスから証明書関連エンドポイントへの複数回のアクセスが攻撃の兆候となる可能性があるとしている。 https://securityonline.info/litespeed-cpanel-privilege-escalation-cve-2026-54420/
Post summary
The post reports that CVE‑2026‑54420, a privilege‑escalation flaw in LiteSpeed’s cPanel plugin, is actively being exploited in shared‑hosting environments, and LiteSpeed has released patches v2.4.8 and WHM v5.3.2.1 to mitigate the issue.
020301.5K
14.8K followersView on X
GovCERT.CZ@GOVCERT_CZ132d
Active Exploitation
🚨 Upozorňujeme na aktivně zneužívanou zranitelnost v LiteSpeed cPanel User-End Plugin, CVE-2026-54420. Zranitelnost typu eskalace oprávnění vzniká při zpracování symbolických odkazů (symlinků), které mohou být vytvořeny nebo upraveny uživateli s omezeným přístupem (např. FTP nebo kompromitované web shell účty), přičemž nedostatečná validace symlinků umožňuje pluginu následovat neautorizované odkazy a tím útočníkovi zpřístupnit citlivé soubory nebo eskalovat oprávnění až na úroveň root v prostředí sdíleného hostingu. Zranitelnost se týká zejména systémů využívajících izolační mechanismy CloudLinux/CageFS, kde dochází k narušení oddělení tenantů, a je aktivně zneužívána v reálných útocích, přičemž útok může probíhat prostřednictvím opakovaných požadavků na API (např. generateEcCert a packageUserSize) a manipulace se symlinky. 📌Doporučujeme aktualizovat na LiteSpeed cPanel Plugin verze 2.4.8 nebo novější a LiteSpeed WHM Plugin verze 5.3.2.1 nebo novější.
Post summary
CVE-2026-54420 is a privilege‑escalation flaw in LiteSpeed cPanel User‑End Plugin actively exploited via symlink manipulation, with patches available to mitigate the risk.
02020377
4.3K followersView on X
Anavem.com@Anavem_134d
Patch
CISA Orders Agencies to Patch CVE-2026-54420 in LiteSpeed #cve202654420 #litespeedcpanelplugin #cisakev https://www.anavem.com/en/news/cybersecurity/cisa-orders-agencies-to-patch-cve-2026-54420-in-litespeed
Post summary
CISA issues a patch advisory for CVE‑2026‑54420 affecting LiteSpeed, with no proof‑of‑concept or exploitation claims mentioned.
01020134
164 followersView on X
Red Secure Tech Ltd.@redsecuretech134d
Patch
CISA adds LiteSpeed cPanel privilege escalation flaw CVE-2026-54420 to KEV catalog. Patch to WHM Plugin v5.3.2.1 by June 18, 2026. https://www.redsecuretech.co.uk/blog/post/litespeed-cpanel-plugin-cve-2026-54420-added-to-kev/1245 #LiteSpeed #CVE #PrivilegeEscalation #CloudLinux #CageFS #SharedHosting #KEVcatalog #CISA #Namecheap #ServerSecurity https://t.co/rG62Zmk79a
Post summary
The tweet announces that CISA added the LiteSpeed cPanel privilege escalation flaw CVE-2026-54420 to the KEV catalog and highlights a patch to WHM Plugin v5.3.2.1, urging users to apply the fix by June 18, 2026.
0101069
64 followersView on X
Lyrie.ai@lyrie_ai110d
Active Exploitation
00:00 UTC: CVE-2026-54420 disclosed. CISA: CVE-2026-54420 added to Known Exploited Vulnerabilities — LiteSpeed cPanel Plugin Status: ✅ Confirmed exploited in the wild Date added: 2026-06-15 Required action: Apply mitigations in accordance with vendor instructions,…
Post summary
CVE-2026-54420, affecting LiteSpeed cPanel plugin, has been confirmed as exploited in the wild; users are urged to apply vendor‐provided mitigations.
1000066
308 followersView on X
Rıdvan Yağlı@ridvanyagli132d
Disclosure
LiteSpeed cPanel user-end plugin'deki kritik yetki yükseltme açığı, FTP/web shell erişimi olan kullanıcıların root yetkisine yükselmesine izin veriyordu, bu açık CVE-2026-54420 olarak kayıt altına alındı ve CISA KEV listesine eklendi.
Post summary
The post announces the disclosure of CVE‑2026‑54420, a privilege‑escalation bug in LiteSpeed cPanel plugins that now appears on the CISA KEV list.
00010143
936 followersView on X
Cybersecurity News Everyday@TweetThreatNews133d
Active Exploitation
Joomla JCE CVE-2026-48907 and LiteSpeed cPanel CVE-2026-54420 are being actively exploited, enabling file uploads, PHP execution, and possible root escalation on shared hosting servers. #Joomla #LiteSpeed #CISA https://ift.tt/fyP8qaT
Post summary
Both CVE-2026-48907 (Joomla JCE) and CVE-2026-54420 (LiteSpeed cPanel) are actively exploited, enabling file uploads, PHP execution, and potential root escalation on shared hosting servers.
00010204
4.4K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir134d
Active Exploitation
🚨 GÜVENLİK BÜLTENİ: CISA, LiteSpeed cPanel Eklentisindeki Kritik Açığa Karşı Uyardı! Merhaba #Brolyz Web barındırma dünyasını ilgilendiren önemli bir gelişme yaşandı. The Hacker News'e göre CISA, LiteSpeed sunucularında kullanılan cPanel eklentisindeki CVE-2026-54420 numaralı yetki yükseltme açığını "Bilinen İstismar Edilen Zafiyetler" (KEV) kataloğuna ekledi. CloudLinux #gibi izole ortamlarda bile root erişimi sağlayabilen bu açık, özellikle paylaşımlı hosting hizmeti veren #orta ve büyük ölçekli işletmeler için ciddi risk oluşturuyor. 📌 Özet CVSS 8.5 puanına sahip CVE-2026-54420, LiteSpeed cPanel eklentisindeki sembolik bağ (symlink) doğrulama eksikliklerinden kaynaklanıyor. Sistemde yalnızca standart FTP veya web shell erişimi bulunan bir kullanıcı, bu açığı kullanarak CageFS benzeri izolasyon katmanlarını aşabiliyor ve root yetkilerine ulaşabiliyor. Açığın aktif olarak istismar edildiği doğrulandı. ⚠️ Riskler • Sunucudaki diğer müşterilere ait veritabanları, e-postalar ve kaynak kodlara erişim • Kalıcılık sağlayarak zararlı yazılım veya fidye yazılımı kurulması • Sunucu altyapısının tamamen ele geçirilmesi • Veri kaybı ve ciddi itibar zararları 🛠️ Çözüm ve Öneriler 1️⃣ Acil Güncelleme: LiteSpeed cPanel eklentisini yamalanmış v2.4.8 sürümüne (WHM eklentisi v5.3.2.1 ile birlikte) veya daha güncel bir sürüme yükseltin. 2️⃣ Geçici Önlem: Güncelleme yapılamıyorsa user-end eklentisini komut satırı üzerinden devre dışı bırakın veya kaldırın. 3️⃣ Log İncelemesi: Şüpheli symlink oluşturma faaliyetlerini ve olağan dışı generateEcCert kayıtlarını inceleyin. İstismar şüphesi varsa tüm parolaları ve API anahtarlarını yenileyin. 🔍 Unutmayın: Paylaşımlı hosting ortamlarında tek bir kullanıcı hesabından başlayan yetki yükseltme saldırısı, tüm sunucunun ele geçirilmesiyle sonuçlanabilir. Sunucularınızdaki üçüncü parti eklentileri güncel tutmayı unutmayın. Güvenli haftalar dilerim! 🛡️
Post summary
CVE-2026-54420 is a high‑score permission‑escalation flaw in LiteSpeed’s cPanel plug‑in that is already being exploited in the wild; administrators should upgrade to the patched version or disable the plug‑in immediately to mitigate the risk.
0001095
333 followersView on X
Divinmentis@Divinmentis134d
Active Exploitation
🔐 KEV alert: CISA added CVE-2026-54420 in LiteSpeed cPanel Plugin to KEV. LiteSpeed says versions before cPanel plugin 2.4.8 are actively exploited and can allow privilege escalation to root on CloudLinux/CageFS shared hosting. #KEV https://t.co/kfGRXkgrfg
Post summary
CISA KEV notes that CVE-2026-54420 in the LiteSpeed cPanel Plugin is actively exploited, allowing privileged users to achieve root access on CloudLinux/CageFS shared hosting environments.
1000052
22 followersView on X
CCB Alert@CCBalert134d
Patch
Warning: #LiteSpeed Technologies releases security updates to fix a vulnerability in the LiteSpeed cPanel Plugin that is being actively exploited. #CVE-2026-54420 (CVSS 8.5) allows an attacker to escalate privileges to root. https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/ #Patch #Patch #Patch
Post summary
LiteSpeed announces a patch for CVE‑2026‑54420, a privilege‑escalation vulnerability that is currently being actively exploited.
00001199
7.2K followersView on X
University of ZERO@zerotalktoai135d
Patch
Oh cPanel servers about to be hacked? Update asap or remove LiteSpeed cPanel Plugin. CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
Post summary
The text warns that cPanel servers are at risk from directory/path traversal and symlink following CVEs and urges immediate patching or plugin removal to mitigate potential exploitation.
0001077
1.6K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	litespeedtech	litespeed_cpanel_plugin	-	-	-
App	litespeedtech	litespeed_whm_plugin	-	-	-

Explore more

Back to dashboard litespeedtech CVEs litespeed_cpanel_plugin vulnerabilities

What researchers are saying

CVE-2026-54420

NooshDaroo | نوشدارو[verified]@NooshDaroo_webPatch

The post announces the CVE‑2026‑54420 vulnerability in LiteSpeed’s cPanel plugin, highlights that it has already been exploited in the wild, and urges immediate patching to version 2.4.8 or a temporary removal as mitigation.

piyokango[verified]@piyokangoActive Exploitation

The post announces two CVEs, noting that CVE-2026-54420 is actively exploited while CVE-2026-20262 has no exploitation evidence, and it provides severity details, official advisory links, and patch information.

yousukezan[verified]@yousukezanActive Exploitation

The post reports that CVE‑2026‑54420, a privilege‑escalation flaw in LiteSpeed’s cPanel plugin, is actively being exploited in shared‑hosting environments, and LiteSpeed has released patches v2.4.8 and WHM v5.3.2.1 to mitigate the issue.

GovCERT.CZ[verified]@GOVCERT_CZActive Exploitation

CVE-2026-54420 is a privilege‑escalation flaw in LiteSpeed cPanel User‑End Plugin actively exploited via symlink manipulation, with patches available to mitigate the risk.

Anavem.com[verified]@Anavem_Patch

CISA issues a patch advisory for CVE‑2026‑54420 affecting LiteSpeed, with no proof‑of‑concept or exploitation claims mentioned.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

CVE-2026-54420, affecting LiteSpeed cPanel plugin, has been confirmed as exploited in the wild; users are urged to apply vendor‐provided mitigations.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

The post announces the disclosure of CVE‑2026‑54420, a privilege‑escalation bug in LiteSpeed cPanel plugins that now appears on the CISA KEV list.

Cybersecurity News Everyday[verified]@TweetThreatNewsActive Exploitation

Both CVE-2026-48907 (Joomla JCE) and CVE-2026-54420 (LiteSpeed cPanel) are actively exploited, enabling file uploads, PHP execution, and potential root escalation on shared hosting servers.