CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

LiteSpeed cPanel/WHM plugin symlink-following on CloudLinux/CageFS shared hosting; exploited ITW May 2026; CISA KEV

cve · CVE-2026-54420

Coverage
1
first 2026-06-16 → last 2026-10-21
Latest activity
2026-06-16
CVE-2026-54420: LiteSpeed cPanel plugin root escalation on CloudLinux/CageFS shared hosting, exploited in the…
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-54420, newest first. Check the date before acting on an older one.

  • Patch the LiteSpeed cPanel plugin (CVE-2026-54420) by upgrading to LiteSpeed WHM PlugIn version 5.3.2.1, which bundles cPanel plugin 2.4.8, or uninstall the user-end plugin until then. It is actively exploited on shared CloudLinux/CageFS hosting. Prioritise any public-sector tenant on shared hosting.
    2026-06-16CVE-2026-54420

Defender insights

What each entry about CVE-2026-54420 tells a defender to do, newest first.

2026-06-16HIGHexploitedCVE-2026-54420: LiteSpeed cPanel plugin root escalation on CloudLinux/CageFS shared hosting, exploited in the wild (CISA KEV)

Exposure · triage · detection

Story timeline

  1. 2026-06-16CVE-2026-54420: LiteSpeed cPanel plugin root escalation on CloudLinux/CageFS shared hosting, exploited in the wild (CISA KEV)
    trending-vulnerabilities

Hunting pivots

Affected products
LiteSpeed cPanel Plugin
Tags
actively-exploitedcisa-kevpriv-escvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-16/cve-2026-54420-litespeed-cpanel-whm-plugin-symlink-following · ATT&CK page ↗

Entries about LiteSpeed cPanel/WHM plugin symlink-following on CloudLinux/CageFS shared hosting; exploited ITW May 2026; CISA KEV (1)

2026-06-16 · view entry permalink →

HIGHCVE-2026-54420exploitedupdatedNATOA1

The LiteSpeed user-end cPanel plugin before 2.4.8, bundled with the LiteSpeed WHM PlugIn and fixed in WHM PlugIn version 5.3.2.1, lets a user with FTP or web-shell access on a CloudLinux/CageFS shared-hosting server escalate to root. LiteSpeed says its WHM plugin itself was not affected, that the flaw "is being actively exploited", and that it was alerted on 2026-05-31 (LiteSpeed, 2026-06-01). The CVE description attributes the flaw to mishandled symlinks (The Hacker News, 2026-06-16) and dates its exploitation in the wild to May 2026 (ENISA EUVD, 2026-06-14); LiteSpeed thanks cPanel, which pushed an uninstall command for the user-end plugin on 2026-05-31, for preventing further exploitation on additional servers (LiteSpeed, 2026-06-01). The Hacker News lists a CVSS score of 8.5 (The Hacker News, 2026-06-16). The CVE description places the vulnerable plugin in WHM PlugIn releases before 5.3.2.0 (The Hacker News, 2026-06-16), while LiteSpeed names WHM PlugIn 5.3.2.1 as its fixed release; both put the user-end plugin fix at 2.4.8 (LiteSpeed, 2026-06-01). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-15 (CISA, 2026-06-15).

Triage: a match can be a false positive. LiteSpeed's discriminators are generateEcCert immediately followed by packageUserSize for the same user, which legitimate UI flows do not chain, 7 to 10 concurrent calls per attempt where the legitimate UI makes one at a time, and the same source IP hammering both endpoints (LiteSpeed, 2026-06-01).

This vulnerability is being actively exploited, and poses a risk for all user-end plugin versions prior to 2.4.8.

LiteSpeed security update
Correctionrun 2026-09-30T0639Z-auditevidencesourcing_notebodyclassificationtechniquestitleheadlinesummaryactionssourcesaffected_products

The main text above described cross-account file access and cited NVD for exploitation and a CVSS 8.5 score. LiteSpeed states that a user with FTP or web-shell access can escalate to root and that the flaw "is being actively exploited", fixed in cPanel plugin 2.4.8 and WHM plugin 5.3.2.1 (LiteSpeed, 2026-06-01). It says only its user-end cPanel plugin is affected, not its WHM plugin, and gives 2026-05-31 as the date it was alerted; the CVE record dates the exploitation itself to May 2026 (ENISA EUVD, 2026-06-14). The 8.5 score is now cited to The Hacker News (The Hacker News, 2026-06-16).

Correctionrun 2026-10-21T0800Z-auditbodycvessourcessummary

The CVE record for CVE-2026-54420 says the flaw was exploited in the wild in May 2026 (ENISA EUVD, 2026-06-14). LiteSpeed gives 2026-05-31 as the date it was alerted, the same day cPanel pushed an uninstall command for the user-end plugin, and thanks cPanel for preventing further exploitation on additional servers (LiteSpeed, 2026-06-01). LiteSpeed's log check therefore applies to servers that have since been upgraded. The CVE description gives the WHM PlugIn boundary as version 5.3.2.0 (The Hacker News, 2026-06-16), while LiteSpeed's fixed release is 5.3.2.1; both put the user-end plugin fix at 2.4.8 (LiteSpeed, 2026-06-01).

vulnerability16 Jun 05:08Zmulti-sourceOpen finding →
Sources: LiteSpeed security update · CISA KEV alert · The Hacker News · ENISA EUVD

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • blog.litespeedtech.com1 (25%)
  • cisa.gov1 (25%)
  • euvd.enisa.europa.eu1 (25%)
  • thehackernews.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)