CISA gives feds 4 days to patch actively exploited cPanel plugin flaw

# Critical LiteSpeed cPanel Plugin Flaw Under Active Exploit—CISA Orders Federal Agencies to Patch in 96 Hours

## The Threat

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive to all U.S. federal agencies to patch a critical privilege escalation vulnerability in the LiteSpeed cPanel user-end plugin by midnight on May 29, 2026—giving government systems just 96 hours to respond to an actively exploited flaw. Tracked as CVE-2026-48172, the vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges on vulnerable servers, effectively granting complete system compromise.

The flaw exists in the lsws.redisAble function within the cPanel plugin's Redis enable/disable feature handler. Rather than properly validating and restricting privilege levels before allowing configuration changes, the vulnerable code incorrectly assigns permissions to functions that should be restricted to administrators only. This permission bypass weakness means any attacker—even one with zero prior authentication or access to the target system—can trigger the vulnerable function and immediately gain root-level code execution.

What makes this particularly dangerous is the widespread installation of the LiteSpeed cPanel plugin. LiteSpeed Web Server is a high-performance replacement for Apache used on millions of shared hosting and VPS platforms worldwide, and the plugin is bundled with cPanel's WHM (WebHost Manager) administration interface. This bundling means vulnerable systems likely span hosting providers, SaaS platforms, content delivery networks, and enterprise infrastructure—potentially exposing hundreds of thousands of endpoints globally. The active exploitation in the wild indicates threat actors have already weaponized this flaw, and the four-day deadline underscores CISA's assessment that federal networks face imminent risk.

## Severity and Impact

| Field | Value |

|-------|-------|

| CVE Identifier | CVE-2026-48172 |

| Vulnerability Type | Improper Privilege Assignment / Privilege Escalation |

| CVSS Score | 9.8 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Complexity | Low |

| Authentication Required | None |

| User Interaction | None |

| Exploitation Status | Actively Exploited |

| Attack Vector | Network |

| Scope | Unchanged |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |

## Affected Products

LiteSpeed Web Server cPanel User-End Plugin:

Affected Platforms (indirect impact):

## Mitigations

Immediate Actions (Priority 1):

1. Upgrade the cPanel plugin to the latest patched version released by LiteSpeed on May 26, 2026, or later

2. Verify your server version using the supplied detection command:

```bash

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

```

If this command returns any output, your system may have been targeted. Review the source IPs and determine if they are legitimate traffic.

Incident Response (Priority 2):

Network Defense (Priority 3):

If Patching is Delayed:

## References

---

## HackWire Analysis

This vulnerability exemplifies a dangerous pattern in web infrastructure: the bundling of administrative tools with web servers creates a massive attack surface that few organizations fully account for. When a plugin ships "by default" in a widely-deployed control panel, every instance is vulnerable until explicitly patched—and many never are. This is not a sophisticated zero-day; it's a straightforward privilege assignment flaw that should have been caught in code review. Yet CISA's emergency directive and reports of active exploitation suggest attackers are moving faster than defenders.

The timing is critical: cPanel and LiteSpeed dominate the shared hosting and managed service provider landscape, meaning a single compromised server can cascade into access to hundreds of customer accounts. An attacker achieving root on a hosting control panel gains not just one victim, but potentially thousands. The 96-hour deadline reflects this amplification effect—federal agencies alone likely host customer data, vendor relationships, and non-public information on shared infrastructure. Every hour of delay increases the window for post-compromise persistence, data exfiltration, and lateral movement.

What's noteworthy is that this flaw required *no authentication*. Unlike many CVEs that require a valid user account or prior access, CVE-2026-48172 is a pure network remote code execution from zero-privilege. This places it in the same threat tier as critical cloud service vulnerabilities: any scanner can identify vulnerable servers, any attacker can exploit them. Organizations running dated versions of cPanel/LiteSpeed should treat this with the same urgency as a critical cloud provider breach.

The forensic guidance LiteSpeed and CISA provided—checking for cpanel_jsonapi_func=redisAble calls and reviewing IP source logs—is a gift to defenders who move quickly. Early detection and containment are possible if organizations prioritize the forensic search within the next 48 hours. Delaying past Friday, May 29, risks missing evidence of initial access before attackers cover their tracks.

— HackWire Editorial

## Related Coverage