Critical Active Exploitation Alert: CVE-2026-48172 in LiteSpeed cPanel Plugin Enables Root Privilege Escalation

Executive Summary

CVE-2026-48172 is a critical privilege escalation vulnerability (CVSS 10.0) affecting the LiteSpeed User-End cPanel Plugin in versions 2.3 through 2.4.4. This flaw allows any authenticated cPanel user—including attackers leveraging compromised accounts—to execute arbitrary scripts as the root user, resulting in full system compromise. The vulnerability arises from incorrect privilege assignment in the lsws.redisAble function, which mishandles the enabling and disabling of Redis features. As of May 2026, this vulnerability is being actively exploited in the wild, with widespread opportunistic attacks targeting web hosting environments. The parent WHM plugin is not affected. Immediate patching and log review are strongly advised.

Threat Actor Profile

Current exploitation of CVE-2026-48172 is characterized by opportunistic threat actors rather than targeted advanced persistent threat (APT) groups. Attackers are leveraging automated tools and scripts to scan for and exploit vulnerable LiteSpeed cPanel Plugin installations across the internet. There is no evidence of a specific threat actor or group orchestrating a coordinated campaign; instead, the exploitation is being conducted by a broad spectrum of cybercriminals seeking to gain root access for purposes such as deploying malware, establishing persistent backdoors, or launching further attacks from compromised infrastructure. Previous campaigns exploiting similar cPanel vulnerabilities have been linked to botnet operators and ransomware distributors, indicating that actors with varying motives and technical sophistication are likely to exploit this flaw.

Technical Analysis of Malware/TTPs

The technical root of CVE-2026-48172 lies in the LiteSpeed User-End cPanel Plugin’s lsws.redisAble function. This function, intended to allow users to enable or disable Redis caching, fails to properly restrict privilege boundaries. As a result, any authenticated cPanel user can invoke this function in a manner that escalates their privileges to root. The vulnerability is classified under CWE-266: Incorrect Privilege Assignment.

Attackers exploit this by sending crafted requests to the plugin’s API endpoint, specifically invoking the cpanel_jsonapi_func=redisAble parameter. Upon successful exploitation, arbitrary scripts or binaries can be executed with root privileges, enabling full control over the server. This includes the ability to install persistent malware, exfiltrate sensitive data, modify system configurations, or pivot to other internal resources.

Observed tactics, techniques, and procedures (TTPs) include the use of automated scanning tools to identify vulnerable servers, followed by exploitation scripts that leverage the API misconfiguration. Post-exploitation activities often involve the deployment of web shells, privilege escalation toolkits, and lateral movement utilities. The exploitation aligns with the MITRE ATT&CK techniques T1068 (Exploitation for Privilege Escalation) and T1059 (Command and Scripting Interpreter).

Exploitation in the Wild

Active exploitation of CVE-2026-48172 has been confirmed by both LiteSpeed Technologies and multiple independent security researchers. Reports from sources such as The Hacker News and SecurityOnline.info indicate that attackers are scanning for and compromising vulnerable servers at scale. There is no evidence of a targeted campaign against specific sectors or geographies; rather, the exploitation is indiscriminate, affecting any organization running the vulnerable plugin.

No public proof-of-concept (PoC) exploit code has been released as of this writing, but the technical simplicity of the vulnerability has enabled threat actors to develop private exploits rapidly. In several documented incidents, compromised servers have been observed hosting malware payloads, participating in botnets, or being used as launchpads for further attacks, including ransomware deployment and credential harvesting.

Victimology and Targeting

Victims of CVE-2026-48172 exploitation are predominantly organizations operating shared hosting environments, managed service providers, and web hosting companies utilizing cPanel with the LiteSpeed User-End Plugin. The vulnerability is not limited by geography or industry vertical; any server running an affected plugin version is at risk. The opportunistic nature of the attacks means that both large-scale hosting providers and smaller organizations with limited security resources are being targeted.

There is no evidence of specific targeting based on sector, country, or organization size. However, the impact is particularly severe for shared hosting environments, where compromise of a single account can lead to root-level access and potential cross-account attacks. Previous exploitation of similar cPanel vulnerabilities has resulted in the deployment of Mirai botnet variants and ransomware such as Sorry ransomware, suggesting that compromised servers may be repurposed for a variety of malicious activities.

Mitigation and Countermeasures

Immediate mitigation of CVE-2026-48172 requires upgrading the LiteSpeed User-End cPanel Plugin to version 2.4.7 or higher, which is bundled with WHM plugin version 5.3.1.0. This patched release includes security hardening and, in earlier patches, temporarily disabled the vulnerable Redis features until a secure implementation was available.

For organizations unable to upgrade immediately, a temporary mitigation is to uninstall the user-end plugin using the following command:

/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall

Administrators should also review server logs for evidence of exploitation. The following command can be used to detect potential abuse:

grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null

If output is present, review the associated IP addresses and block any that are unauthorized. Further investigation should include examining system logs for unauthorized script execution, privilege escalation attempts, and the presence of unfamiliar binaries or web shells.

Additional best practices include enforcing the principle of least privilege for all user accounts, monitoring for anomalous activity, and ensuring that all software components are kept up to date with the latest security patches. Organizations should also consider implementing network segmentation and multi-factor authentication to reduce the risk of lateral movement and account compromise.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization’s digital ecosystem, or for any questions regarding this advisory, please contact us at ops@rescana.com.