CISA has urged federal agencies to urgently patch a critical vulnerability in the LiteSpeed user-end plugin for cPanel, tracked as CVE-2026-48172, which allows attackers to execute arbitrary scripts with root privileges. The flaw has been actively exploited, and users are advised to upgrade to the patched version or remove the vulnerable plugin to mitigate risks.
The critical vulnerability CVE-2026-48172 in the LiteSpeed user-end plugin for cPanel, with a CVSS score of 9.8, is actively exploited and allows privilege escalation. CISA recommends immediate patching or removal of the plugin to prevent unauthorized root access. Ensure all systems are updated to the latest version (2.4.7) or completely remove the plugin if patching isn't feasible.