LiteSpeed cPanel CVE-2026-48172 (CVSS 10.0) Root Exploit

A maximum-severity vulnerability, CVE-2026-48172, impacting the LiteSpeed User-End cPanel Plugin is under active exploitation. This critical flaw allows an attacker to execute arbitrary scripts with root privileges due to an incorrect privilege assignment. The vulnerability carries a CVSS score of 10.0.

Active exploitation of this privilege escalation vulnerability creates a significant risk to affected systems. Any cPanel user, or a compromised account, can use this flaw to gain elevated permissions and achieve full system compromise. Administrators using the affected plugin versions must take urgent action.

LiteSpeed has released patches for CVE-2026-48172 and other potential attack vectors discovered during a subsequent security review. Organizations should immediately review their plugin versions and apply the recommended updates or implement the provided mitigation strategy. This incident follows closely on another critical cPanel vulnerability, CVE-2026-41940, also undergoing active exploitation, demonstrating the consistent threat to web hosting environments.

What is CVE-2026-48172 and why is it critical?

CVE-2026-48172 is a maximum-severity security vulnerability affecting the LiteSpeed User-End cPanel Plugin, identified as an incorrect privilege assignment issue. This flaw permits an unprivileged cPanel user to execute arbitrary scripts with root permissions on the underlying server. The vulnerability has a CVSS score of 10.0, reflecting its critical nature and extreme potential for system compromise.

The criticality of CVE-2026-48172 comes from the level of access an attacker can achieve. Running arbitrary scripts as root grants complete control over the compromised server, allowing data exfiltration, service disruption, malware deployment, or persistent access. This elevates what would typically be a local privilege escalation (LPE) into a remote code execution (RCE) scenario if the attacker first gains access to any cPanel account, even a low-privileged or compromised one. The active exploitation observed in the wild further shows the immediate and severe threat posed by this vulnerability, requiring prompt remediation.

Impact

An attacker exploiting CVE-2026-48172 can achieve full system compromise by running arbitrary scripts with root privileges. This level of access grants complete control over the server, including the ability to read, modify, or delete any file, install software, and manipulate system configurations. The primary risk is to any server running the vulnerable LiteSpeed User-End cPanel Plugin, as any cPanel user, or an attacker using a compromised cPanel account, can initiate the exploit.

The consequences of such a compromise are extensive. Attackers could deploy web shells for persistent access, install cryptominers, host malicious content, or pivot to other systems within the network. Given the typical environment for cPanel - shared hosting or dedicated servers managing multiple websites - a successful exploit could impact numerous customers or hosted services simultaneously. The CVSS score of 10.0 accurately reflects this severe impact, indicating that the vulnerability is easily exploitable with no complex prerequisites and has a devastating effect on confidentiality, integrity, and availability. For more context on actively exploited privilege escalation vulnerabilities, refer to our prior analysis of a similar threat in a widely used endpoint security product, as discussed in our prior analysis of CVE-2026-41091 in Microsoft Defender.

Exploitation chain

The exploitation chain for CVE-2026-48172 is straightforward, relying on an incorrect privilege assignment within the LiteSpeed User-End cPanel Plugin. Specifically, the vulnerability resides in the lsws.redisAble function. This function, intended for specific operations, can be abused by any authenticated cPanel user to execute arbitrary scripts with root privileges on the server.

The primary attack vector is through this misconfigured function, where the system fails to adequately restrict the execution context, allowing a less-privileged user to escalate their permissions. Preconditions for exploitation involve an attacker or a compromised account having legitimate access to any cPanel user interface. No advanced technical expertise or complex authentication bypasses are required beyond valid cPanel user credentials. Security researcher David Strydom discovered and reported this critical flaw. LiteSpeed has confirmed that CVE-2026-48172 is actively exploited, indicating that threat actors are aware of the vulnerability and have developed working exploits. This confirms the urgency for immediate patching. For more details on another actively exploited root access vulnerability, refer to our analysis on CVE-2026-31431 Linux root access.

Affected products and versions

The vulnerability CVE-2026-48172 specifically impacts the LiteSpeed User-End cPanel Plugin. Administrators must differentiate this from the LiteSpeed WHM plugin, which is not affected by this particular vulnerability.

The following versions of the LiteSpeed User-End cPanel Plugin are vulnerable:

  • All versions from 2.3 up to and including 2.4.4.

Administrators should verify the version of their LiteSpeed User-End cPanel Plugin to determine if their installations are at risk. Installations running any version within this range require immediate attention.

Detection

Detecting potential exploitation attempts of CVE-2026-48172 requires reviewing cPanel access logs for specific function calls. LiteSpeed has provided a direct indicator of compromise (IOC) with a grep command that searches for the suspicious cpanel_jsonapi_func=redisAble string, which indicates an attempted or successful exploit.

Administrators should execute the following command on their servers:

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

Interpretation of the command's output:

  • No Output: If the command returns no output, it suggests the specific redisAble function call associated with the exploit has not been logged on the server. While this indicates no direct evidence of exploitation through this IOC, it does not preclude other forms of compromise or future attempts.
  • Output Present: If the command produces output, the cpanel_jsonapi_func=redisAble string has been found in the cPanel logs. Each line of output will likely include details such as the timestamp and the originating IP address.
  • Immediate Action: Administrators must thoroughly examine the IP addresses listed in the output. Determine if these IP addresses are legitimate, known, and expected administrative or user access points.
  • Blocking Malicious IPs: If any IP addresses are identified as suspicious or malicious, they should be immediately blocked at the network perimeter (e.g., firewall, IP tables).
  • Incident Response: Any confirmed exploitation necessitates a full incident response procedure, including forensic analysis to determine the extent of compromise, potential data exfiltration, and any persistent mechanisms left by the attacker. This should include reviewing system logs for further anomalous activity, checking for newly created users or files, and assessing the integrity of the web environment.

Given the active exploitation of CVE-2026-48172, continuous monitoring of cPanel access logs for this specific signature is advisable even after patching, as part of a complete security posture.

Remediation

Remediation for CVE-2026-48172 requires updating the LiteSpeed User-End cPanel Plugin to a patched version. LiteSpeed has released updates that address this vulnerability and other potential attack vectors discovered during a subsequent security review.

The primary remediation steps are as follows:

  • Patching: The most effective remediation is to upgrade to the latest secure version of the LiteSpeed plugin.
  • Upgrade to LiteSpeed WHM Plugin version 5.3.1.0. This WHM plugin version is bundled with cPanel plugin v2.4.7 or higher, which includes the necessary patches for CVE-2026-48172 and additional security fixes. This is the recommended update path for full protection. Further details on this specific vulnerability and its resolution are available in our post on the LiteSpeed cPanel Plugin vulnerability.
  • Workaround/Mitigation (If immediate patching is not feasible): If an immediate upgrade is not possible, the user-end plugin can be uninstalled as a temporary mitigation.
  • To remove the vulnerable user-end plugin, execute the following command on the server:
        /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall
  • Uninstalling the plugin may affect functionality that relies on the LiteSpeed User-End cPanel Plugin. Evaluate the operational impact before proceeding with this workaround. This measure should be considered a temporary solution until the recommended patch can be applied.
  • Post-Remediation Monitoring: After applying patches or implementing the workaround, continue to monitor server logs for any indicators of compromise mentioned in the detection section, or any other anomalous activity. This vigilance helps confirm that the remediation was successful and no lingering threats remain.

Prioritize the upgrade to LiteSpeed WHM Plugin version 5.3.1.0 as it includes broader security enhancements beyond just CVE-2026-48172.

Technical Takeaways

  • CVE-2026-48172 is a critical privilege escalation vulnerability in the LiteSpeed User-End cPanel Plugin, assigned a CVSS score of 10.0.
  • The vulnerability, an incorrect privilege assignment within the lsws.redisAble function, allows any cPanel user to execute arbitrary scripts with root privileges.
  • This flaw is currently under active exploitation, requiring immediate attention and remediation.
  • Affected versions of the LiteSpeed User-End cPanel Plugin range from 2.3 to 2.4.4. The LiteSpeed WHM plugin is not directly impacted by CVE-2026-48172.
  • Remediation requires upgrading to LiteSpeed WHM Plugin version 5.3.1.0 (which includes cPanel plugin v2.4.7 or higher), or as a temporary measure, uninstalling the user-end plugin.
  • Detection is done by searching cPanel logs for cpanel_jsonapi_func=redisAble to identify potential exploitation attempts.