Skip to content
Sign in
CVE-2026-544208.5HighCWE-61

LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

LiteSpeed · cPanel Plugin

Exploited in the wild · in CISA KEV since 15 JunVendor fix available
1.4%probability of exploitation in the next 30 days
73rd percentile
050100

Higher than 73% of scored CVEs

8.5HighCVSS 3.1
LowHigh

Federal deadline

CISA KEV · added 15 Jun · catalogue entry

Passed 133 days ago

DescriptionNVD

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage8 articles · 4 outlets

First in our coverage: CISA, 15 Jun.

Full timeline
Quiet for 6 weekslast report 15 Sep8 articles4 outlets
15 Jun · CISA first31 Jul23 Aug15 Sep8 OctNow
  • Mon 15 Jun, 19:40 UTC. CISA, first report. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline, its first report on the story. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts
    Security Affairs · mentions it in passing
  2. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root
    SecurityWeek · mentions it in passing
  3. Could Apple Build Its Own OpenClaw Competitor?
    SecurityOnline
  4. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack
    Security Affairs · mentions it in passing
  5. Inside the Stealthy Agent Tesla Infection Chain
    SecurityOnline
  6. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed
    SecurityOnline
  7. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability
    CISA · official notice
  8. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue
    CISA · official notice · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in