Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed

Part of the CVE-2026-54420 story · since 15 Jun

Quiet for 6 weekslast report 15 Sep8 articles4 outlets
15 Jun · CISA first31 Jul23 Aug15 Sep8 OctNowThis article3rd of 8
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.

Two critical vulnerabilities have been detected: CVE-2026-54420 affects the LiteSpeed cPanel Plugin, enabling privilege escalation for low-privileged users to gain root access, and CVE-2026-20262 pertains to Cisco Catalyst SD-WAN Manager allowing directory traversal. Administrators are urged to patch their systems urgently as these exploits are currently active. The LiteSpeed vulnerability, rated 8.5 on the CVSS scale, allows users on shared servers to escape their boundaries and threatens multiple accounts. LiteSpeed has addressed the issue in version 2.4.8; upgrading is advised to mitigate risks.

How the story developed

All 8 articles
Quiet for 6 weekslast report 15 Sep8 articles4 outlets

8 articles from 4 outlets since 15 Jun. Quiet since 15 Sep. This was the 3rd report, 6 hours after the first.

Now15 Jun171814 Sep1617First reportCISA · 15 Jun, 19:40This article3rd of 8 · day 1
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV. This article, 3rd of 8.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Mon 15 JunDay 02
    1. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue19:40 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability20:16 · CISA · official · Known exploited CVE
  2. Tue 16 JunDay 14
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE · This article, 3rd of 8
    2. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    3. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    4. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
  3. Wed 17 JunDay 21
    1. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE

  4. Quiet for 13 weeks

    Tue 15 SepDay 921
    1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts13:13 · Security Affairs · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in