Skip to content
Sign in

LiteSpeed product

cPanel Plugin

Alert
No CISA KEV deadline is open. CISA last added a cPanel Plugin CVE on 15 Jun.

Tracked since 23 May · latest article 15 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 2 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date2

cPanel Plugin CVEs in CISA KEV with their federal deadlines. None is open.

Exploited cPanel Plugin CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-54420cPanel Plugin15 JunPassed 18 Jun8
In CISA KEVCVE-2026-48172cPanel Plugin26 MayPassed 29 May7
Vendor CSV of 2 entries for LiteSpeedAll 2 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds cPanel Plugin CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’262Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20262
Q3 20260
Q4 20260

Fix listed

2 of 2 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-48172: 97.2th percentile, in CISA KEVCVE-2026-54420: 73.1th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-4817297.2
CVE-2026-5442073.1

Coverage14 articles · all time

The latest 14 articles naming cPanel Plugin, in the shared story grammar.

Full timeline
Quiet for 6 weekslast report 15 Sep14 articles5 outlets

14 articles from 5 outlets since 23 May. Quiet since 15 Sep.

Now23 May3025811141714 SepFirst reportThe Hacker News · 23 May, 08:30CISA alert26 May, 18:52 · official
  • Sat 23 May, 08:30 UTC. The Hacker News, first report. LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-48172. Cites a CVE in CISA KEV.
  • Tue 26 May, 18:52 UTC. CISA, its first report on the story. CISA Adds Critical LiteSpeed cPanel Plugin Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Tue 26 May, 21:09 UTC. CISA. CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV. Cites a CVE in CISA KEV.
  • Wed 27 May, 07:11 UTC. SecurityWeek, its first report on the story. CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin. Cites a CVE in CISA KEV.
  • Wed 27 May, 14:02 UTC. SecurityOnline, its first report on the story. Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants. Cites a CVE in CISA KEV.
  • Thu 28 May, 10:31 UTC. Security Affairs, its first report on the story. CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:40 UTC. CISA. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:16 UTC. CISA. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Tue 15 Sep, 13:13 UTC. Security Affairs. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 14 articles as a list
  1. Sat 23 MayDay 01
    1. LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-4817208:30 · The Hacker News · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 3 days

    Tue 26 MayDay 32
    1. CISA Adds Critical LiteSpeed cPanel Plugin Flaw to KEV Catalogue18:52 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV21:09 · CISA · official · Known exploited CVE
  3. Wed 27 MayDay 42
    1. CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin07:11 · SecurityWeek · Known exploited CVE
    2. Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants14:02 · SecurityOnline · Known exploited CVE
  4. Thu 28 MayDay 51
    1. CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog10:31 · Security Affairs · Known exploited CVE

  5. Quiet for 3 weeks

    Mon 15 JunDay 232
    1. CISA Adds CVE-2026-54420 to Known Exploited Vulnerabilities Catalogue19:40 · CISA · official · Picked up again · Known exploited CVE
    2. CISA flags LiteSpeed cPanel Plugin UNIX symlink vulnerability20:16 · CISA · official · Known exploited CVE
  6. Tue 16 JunDay 244
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    3. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    4. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
  7. Wed 17 JunDay 251
    1. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE

  8. Quiet for 13 weeks

    Tue 15 SepDay 1151
    1. LiteSpeed Server Flaw Lets Tenants Escape Shared Hosting Accounts13:13 · Security Affairs · Picked up again · Known exploited CVE

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-48172Exploited

    LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

    10.0Critical18% EPSS · 7 articles
  • CVE-2026-54420Exploited

    LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability

    8.5High1.4% EPSS · 8 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in