Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin

Part of the CVE-2026-48172 story · since 23 May

Quiet for 6 weekslast report 15 Sep7 articles5 outlets
23 May · The Hacker News first7 Sep4 OctNowThis article4th of 7
  • Sat 23 May, 08:30 UTC. The Hacker News, first report. LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-48172. Cites a CVE in CISA KEV.
  • Tue 26 May, 18:52 UTC. CISA, its first report on the story. CISA Adds Critical LiteSpeed cPanel Plugin Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Tue 26 May, 21:09 UTC. CISA. CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV. Cites a CVE in CISA KEV.
  • Wed 27 May, 07:11 UTC. SecurityWeek, its first report on the story. CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin. Cites a CVE in CISA KEV. This article, 4th of 7.
  • Wed 27 May, 14:02 UTC. SecurityOnline, its first report on the story. Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants. Cites a CVE in CISA KEV.
  • Thu 28 May, 10:31 UTC. Security Affairs, its first report on the story. CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.

CISA has urged federal agencies to patch a critical vulnerability (CVE-2026-48172) in the LiteSpeed user-end plugin for cPanel, which is being actively exploited in the wild. The vulnerability, a privilege escalation issue with a CVSS score of 9.8, allows attackers to execute arbitrary scripts with root privileges. LiteSpeed released a fix in version 2.4.5 and recommended users upgrade to WHM Plugin version 5.3.1.0 or remove the plugin entirely. cPanel has also removed the vulnerable plugin from all versions. Agencies are advised to act by May 29, in line with CISA's guidance on Known Exploited Vulnerabilities.

How the story developed

All 7 articles
Quiet for 6 weekslast report 15 Sep7 articles5 outlets

7 articles from 5 outlets since 23 May. Quiet since 15 Sep. This was the 4th report, 4 days after the first.

Now23 May25272914 Sep16First reportThe Hacker News · 23 May, 08:30This article4th of 7 · day 4
  • Sat 23 May, 08:30 UTC. The Hacker News, first report. LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-48172. Cites a CVE in CISA KEV.
  • Tue 26 May, 18:52 UTC. CISA, its first report on the story. CISA Adds Critical LiteSpeed cPanel Plugin Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Tue 26 May, 21:09 UTC. CISA. CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV. Cites a CVE in CISA KEV.
  • Wed 27 May, 07:11 UTC. SecurityWeek, its first report on the story. CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin. Cites a CVE in CISA KEV. This article, 4th of 7.
  • Wed 27 May, 14:02 UTC. SecurityOnline, its first report on the story. Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants. Cites a CVE in CISA KEV.
  • Thu 28 May, 10:31 UTC. Security Affairs, its first report on the story. CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 7 articles as a list
  1. Sat 23 MayDay 01
    1. LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-4817208:30 · The Hacker News · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 3 days

    Tue 26 MayDay 32
    1. CISA Adds Critical LiteSpeed cPanel Plugin Flaw to KEV Catalogue18:52 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV21:09 · CISA · official · Known exploited CVE
  3. Wed 27 MayDay 42
    1. CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin07:11 · SecurityWeek · Known exploited CVE · This article, 4th of 7
    2. Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants14:02 · SecurityOnline · Known exploited CVE
  4. Thu 28 MayDay 51
    1. CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog10:31 · Security Affairs · Known exploited CVE

  5. Quiet for 16 weeks

    Tue 15 SepDay 1151
    1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts13:13 · Security Affairs · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in