THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

VERIFIEDBy Xavier Rivera· ·1.5 min read

CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

CISA has given federal agencies three days to address CVE-2026-48172, an actively exploited privilege escalation flaw in the LiteSpeed cPanel plugin that lets unauthenticated attackers gain root execution. The agency is also pressing private-sector organizations to install vendor updates immediately.

Source:BleepingComputer

Post

CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

TL;DRAI · 60 sec read

Critical vulnerability in LiteSpeed's cPanel user-end plugin

The Cybersecurity and Infrastructure Security Agency has directed federal civilian executive branch organizations to secure their systems against a severe privilege escalation flaw in the LiteSpeed cPanel plugin that is reportedly under active exploitation.

Tracked as CVE-2026-48172, the issue stems from improper handling of Redis enable and disable operations inside the lsws.redisAble function. This incorrect privilege assignment allows unauthenticated remote attackers to run arbitrary scripts with root-level access.

The vulnerability stems from an incorrect privilege assignment weakness that enables remote attackers with no privileges to execute arbitrary scripts with root privileges.

LiteSpeed issued emergency patches on Thursday, urging administrators to upgrade the cPanel user-end plugin — which is bundled with the WHM plugin — to the newest release. The company stated that versions between v2.3 and v2.4.4 are at risk.

POST FROM @litespeedtech· official vendor announcement tweet about the cPanel plugin security update referenced in the article

https://x.com/litespeedtech/status/2057479889930817601

To determine exposure, server operators can run: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null. "If this command results in any output, we recommend you examine the IPs in the list, determine if they are valid, and if not, block them. To determine any damage done, examine the system logs for any actions taken by the detected IPs," the LiteSpeed team noted.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

Federal patching deadline

CISA warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA added the flaw Tuesday to its Known Exploited Vulnerabilities catalog and required agencies to remediate by Friday, May 29, under Binding Operational Directive (BOD) 22-01. Although the directive targets only federal agencies, the agency called on all organizations, including those in the private sector, to apply fixes without delay.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned. "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

The flaw was publicly disclosed and patched the same week it appeared on CISA's exploitation list.

EXPERT TAKE

Administrators should immediately audit logs with the provided grep command and update any LiteSpeed cPanel user-end plugin versions between v2.3 and v2.4.4 to block active exploitation attempts.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

CISA vulnerability security cPanel LiteSpeed

MORE IN TECH

Xi calls for AI emergency systems and global openness

Xi Jinping has called for AI openness paired with emergency response systems and new global governance structures, while Asia sees a major Coupang warehouse fire and fresh Indian chip subsidies. The developments highlight competing priorities of innovation, risk control, and regional industrial policy.

SigNoz 0.133.0 Open Redirect Lets Attackers Steal SSO Tokens

SigNoz through 0.133.0 is affected by a reported open redirect in the SSO flow (referenced in NVD as CVE-2026-63094) that lets unauthenticated attackers steal access and refresh tokens from users on Google OAuth, SAML, or OIDC instances. The CVSS 3.1 score of 8.1 from VulnCheck marks it high severity and requires immediate patching on affected self-hosted deployments.

Critical Privilege Escalation Flaw Reported in WordPress Plugin Aimogen Pro

Aimogen Pro for WordPress through version 2.8.4 allows unauthenticated privilege escalation because the aiomatic_call_google_ai_function omits a capability check, letting attackers clear blacklists and run arbitrary PHP such as creating admin accounts. Wordfence rates it critical at CVSS 9.8; the CVE reached NVD on July 17, 2026.