An important security flaw has been found in the LiteSpeed cPanel plugin, which could allow an attacker to gain full control over a server. This issue, tracked as CVE-2026-54420, is particularly concerning because it has been actively used in real-world attacks. If you use LiteSpeed with cPanel, understanding and addressing this vulnerability quickly is crucial for your server’s security.
CVE Details
Product Name: LiteSpeed cPanel Plugin, LiteSpeed WHM Plugin
Published Date: June 14, 2026
Severity: High
Status: Analyzed
Overview
The vulnerability exists in how the LiteSpeed cPanel plugin handles symlinks, or symbolic links. If an attacker has even limited access to your server through FTP or a web shell, they can exploit this flaw. On shared hosting environments, especially those running CloudLinux/CageFS, this can lead to a privilege escalation, meaning the attacker could gain root-level access. This level of access grants complete control over the server, allowing for data theft, website defacement, or further malicious activities. The vulnerability was actively exploited in May 2026.
Affected Products
This vulnerability impacts specific versions of the LiteSpeed cPanel plugin and the LiteSpeed WHM plugin:
- LiteSpeed cPanel plugin versions earlier than 2.4.8
- LiteSpeed WHM Plugin versions earlier than 5.3.2.0 (as the cPanel plugin is bundled within the WHM plugin)
Current Status
The vulnerability has been thoroughly analyzed by LiteSpeed Technologies and a fix has been released. It’s crucial to note that this flaw was actively exploited in the wild, which underscores the urgency of applying the available solutions.
Severity Level
This vulnerability is rated as High severity with a CVSS score of 8.5. A high severity rating indicates that exploiting this flaw can have a significant impact, potentially leading to a complete compromise of the affected system. The fact that it allows for privilege escalation to root access means an attacker could gain full control, making immediate action essential.
Possible Solutions
LiteSpeed Technologies has provided an urgent update to address this vulnerability. The most effective solution is to update your LiteSpeed WHM Plugin to the latest version.
Recommended Action: Upgrade
You should upgrade your LiteSpeed WHM Plugin to v5.3.2.1 or higher. This version includes the patched cPanel plugin (v2.4.8).
To update the WHM plugin, which will also update the user-end cPanel plugin if installed, run the following command:
wget -O- https://litespeedtech.com/packages/cpanel/lsws_whm_plugin_install.sh | shTemporary Mitigation (if immediate upgrade is not possible)
If you cannot update immediately, you can temporarily remove the user-end cPanel plugin to mitigate the vulnerability:
/usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstallAfter upgrading the WHM plugin, you can reinstall the user-end plugin and enable autoinstall with these commands:
/usr/local/lsws/admin/misc/lscmctl cpanelplugin --install
/usr/local/lsws/admin/misc/lscmctl cpanelplugin -autoinstall 1Detecting Exploitation
To check if your server might have been affected, run this command:
grep -rE 'cpanel_jsonapi_func=(generateEcCert|packageUserSize)|cert_action_entry .*geneccert' /usr/local/cpanel/logs/ /var/cpanel/logs/ 2>/dev/nullIf there is no output, your server has likely not been affected. If there is output, look for the following patterns to confirm potential exploitation:
- A `generateEcCert` call immediately followed by `packageUserSize` for the same user.
- Multiple concurrent calls (7-10 per attempt).
- The same source IP repeatedly targeting both endpoints.
If exploitation is confirmed, examine your system logs for any unauthorized actions from the detected IP addresses. Contact LiteSpeed support if you need assistance.
References
- https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
- https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420
