The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a security flaw in the LiteSpeed cPanel Plugin in its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies implement fixes by June 18, 2026.
The vulnerability, identified as CVE-2026-54420 (CVSS score: 8.5), is characterized as a privilege escalation issue. It permits a user with FTP or web shell access to elevate privileges to root on shared hosting servers operating CloudLinux or CageFS.
"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS," according to a description of the vulnerability on CVE.org.
It remains unclear how the vulnerability is being exploited in real-world scenarios and whether any such attacks have succeeded, but LiteSpeed has advised users to execute the command below to determine if their servers are affected:
If the grep command yields no output, it signifies that the server has not been impacted by the issue. If any output appears, LiteSpeed has provided additional indicators to eliminate false positives:
generateEcCert immediately followed by packageUserSize for the same user (legitimate UI flows do not chain these)
7-10 concurrent calls per attempt (legitimate UI performs one at a time)
Namecheap has been credited with reporting the issue on May 31, 2026. Users are recommended to upgrade to LiteSpeed WHM Plugin v5.3.2.1 (bundled with cPanel plugin v2.4.8) or later to address the vulnerability.