Vulnerability intelligence

CVE-2026-54420

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

CVSS Score

8.5

High

EPSS — Exploit Probability

1.4%

Riskier than 70% of all CVEs

Exploitation

Confirmed in the wild

KEV since 2026-06-15

Remediation

Patch available

Federal deadline 2026-06-18

NVD entry Vendor patch PoC / advisory CISA KEV

7 articles across 5 outlets · first covered Jun 15, 2026 · latest Jun 17, 2026

Tracked incidents

vulnerability closed 12 articles

CISA adds actively exploited Joomla, Cisco and LiteSpeed flaws to KEV catalog

Coverage timeline

Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root
www.securityweek.com · Jun 17, 2026
Could Apple Build Its Own OpenClaw Competitor?
securityonline.info · Jun 16, 2026
CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack
securityaffairs.com · Jun 16, 2026
Inside the Stealthy Agent Tesla Infection Chain
securityonline.info · Jun 16, 2026
LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed
securityonline.info · Jun 16, 2026
CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability
www.cisa.gov · Jun 15, 2026
CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue
cisa.gov · Jun 15, 2026