LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts

A critical vulnerability in LiteSpeed Web Server Enterprise could allow a low-privilege user on a shared-hosting server to escape their account and gain root-level access, cPanel warned on 14 September 2026. The flaw can bypass account-isolation controls, including CloudLinux’s CageFS, potentially allowing one tenant to access or alter other customers’ websites and the underlying server. It affects Enterprise versions before 6.3.7.

Neither cPanel nor LiteSpeed has published technical details, a CVE identifier or a severity rating, and there is no confirmation that the issue is being exploited.

Administrators are urged to update to LiteSpeed Enterprise 6.3.7 using `/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7`. LiteSpeed said the release might take time to reach its stable automatic-update channel; as of 15 September, its download page still listed 6.3.6 as the latest stable version. The forced update temporarily leaves that channel, which can be restored later.

The advisory provides no workaround for systems that cannot be patched, applies only to the Enterprise edition, and does not report a corresponding update for OpenLiteSpeed. The report also notes that two earlier LiteSpeed cPanel plugin flaws, CVE-2026-48172 and CVE-2026-54420, were actively exploited and added by CISA to its Known Exploited Vulnerabilities catalogue.