THE CIRCUITRYYour one-stop source for all tech news

Home/Tech/CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

VERIFIEDBy Xavier Rivera· ·1.5 min read

CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

CISA has given federal agencies three days to address CVE-2026-48172, an actively exploited privilege escalation flaw in the LiteSpeed cPanel plugin that lets unauthenticated attackers gain root execution. The agency is also pressing private-sector organizations to install vendor updates immediately.

Source:BleepingComputer

Post

CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw

TL;DRAI · 60 sec read

Critical vulnerability in LiteSpeed's cPanel user-end plugin

The Cybersecurity and Infrastructure Security Agency has directed federal civilian executive branch organizations to secure their systems against a severe privilege escalation flaw in the LiteSpeed cPanel plugin that is reportedly under active exploitation.

Tracked as CVE-2026-48172, the issue stems from improper handling of Redis enable and disable operations inside the lsws.redisAble function. This incorrect privilege assignment allows unauthenticated remote attackers to run arbitrary scripts with root-level access.

The vulnerability stems from an incorrect privilege assignment weakness that enables remote attackers with no privileges to execute arbitrary scripts with root privileges.

LiteSpeed issued emergency patches on Thursday, urging administrators to upgrade the cPanel user-end plugin — which is bundled with the WHM plugin — to the newest release. The company stated that versions between v2.3 and v2.4.4 are at risk.

POST FROM @litespeedtech· official vendor announcement tweet about the cPanel plugin security update referenced in the article

https://x.com/litespeedtech/status/2057479889930817601

To determine exposure, server operators can run: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null. "If this command results in any output, we recommend you examine the IPs in the list, determine if they are valid, and if not, block them. To determine any damage done, examine the system logs for any actions taken by the detected IPs," the LiteSpeed team noted.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

Federal patching deadline

CISA warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA added the flaw Tuesday to its Known Exploited Vulnerabilities catalog and required agencies to remediate by Friday, May 29, under Binding Operational Directive (BOD) 22-01. Although the directive targets only federal agencies, the agency called on all organizations, including those in the private sector, to apply fixes without delay.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned. "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

The flaw was publicly disclosed and patched the same week it appeared on CISA's exploitation list.

EXPERT TAKE

Administrators should immediately audit logs with the provided grep command and update any LiteSpeed cPanel user-end plugin versions between v2.3 and v2.4.4 to block active exploitation attempts.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

CISA vulnerability security cPanel LiteSpeed

MORE IN TECH

Tesla and SpaceX confirm Terafab chip fab in Texas

Tesla and SpaceX have confirmed Grimes County, Texas as the site for their Terafab semiconductor megafactory, with the first phase costing roughly $16.8 billion. The project targets the largest chip manufacturing facility on the planet to supply over 1 terawatt of compute per year that exceeds current and future global production capacity.

OpenAI Urges Federal Judge to Throw Out Apple's Trade Secrets Complaint

OpenAI has filed a motion asking a federal judge to dismiss Apple's trade secrets lawsuit, describing the claims as meritless. The dispute, which follows a July suit and this week's injunction request from Apple, highlights tensions after their prior partnership on Siri and OpenAI's hardware push.

Meta introduces Muse Code, its terminal-based coding agent

Meta has released an early beta of Muse Code, a terminal-based coding agent driven by the updated Muse Spark 1.2 model and positioned against Anthropic's Claude Code and OpenAI's Codex. Substantially lower rates, including a contributor plan at $0.10 for every million tokens received, may encourage migration away from higher-priced options such as Anthropic's Sonnet 5.