CISA gives feds 4 days to patch actively exploited cPanel plugin flaw
CISA gave U.S. agencies four days to patch an actively exploited LiteSpeed cPanel plugin bug that can let attackers run code as root.
Intelligence analysis by GPT-5.4 Mini
CISA added a critical LiteSpeed cPanel user-end plugin flaw to its exploited-vulnerabilities catalog and set a Friday, May 29 deadline for federal patching. The bug can let remote attackers without privileges run scripts as root, and LiteSpeed says affected versions run from v2.3 through v2.4.4.
A security hole was found in a tool that helps some web servers work. Bad actors are already using it, and the problem is serious because it can let them become the main boss of the computer.
CISA, the U.S. government’s cyber warning team, told federal agencies to fix it very fast. That is like a fire alarm saying, “This one cannot wait until next week.”
The company that makes the tool says people should update it right away and check the server’s logs for strange activity. It is like looking for footprints after someone may have sneaked into a house.
Analysis
What happened
CISA added CVE-2026-48172 to its catalog of vulnerabilities known to be exploited in attacks and told U.S. federal agencies to patch by midnight on Friday, May 29, under Binding Operational Directive 22-01. The target is the LiteSpeed cPanel user-end plugin, which LiteSpeed says is being actively exploited.
Why the bug is dangerous
The flaw is described as a privilege-escalation issue tied to mishandling Redis enable and disable functionality in the lsws.redisAble function. In practical terms, an attacker with no special privileges can abuse the bug to run arbitrary scripts as root. That is the kind of access that can turn a small foothold into full server compromise.
Vendor response and detection advice
LiteSpeed released urgent updates on Thursday and urged users to upgrade the cPanel user-end plugin, bundled with the WHM plugin, to the latest version. The company says the vulnerable range covers user-end plugin versions from v2.3 through v2.4.4. It also published a log check using grep to look for cpanel_jsonapi_func=redisAble in cPanel logs; if the command returns results, LiteSpeed recommends checking the source IPs, blocking suspicious ones, and reviewing system logs for actions taken by those IPs.
Broader takeaway
Although CISA’s order applies to federal agencies, the agency also told all defenders to prioritize patching and, if mitigations are not available, to follow vendor guidance or stop using the product. The story is a reminder that internet-facing hosting components remain attractive targets, especially when a privilege bug can become root access with little friction.
Key points
- CISA added CVE-2026-48172 to its list of vulnerabilities being actively exploited.
- The flaw affects the LiteSpeed cPanel user-end plugin and can let attackers run scripts as root.
- LiteSpeed says affected versions run from v2.3 through v2.4.4.
- U.S. federal agencies must patch by midnight on Friday, May 29, under BOD 22-01.
- LiteSpeed advises checking logs for `cpanel_jsonapi_func=redisAble` and reviewing suspicious IPs.
