CVE-2026-48172

Act now ● On CISA KEV — actively exploited

Actively exploited — on the CISA KEV list.

CVSS base

9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — probability of exploitation (30 days)

18.9%

97.2th percentile

CISA KEV

Listed

Added 2026-05-26 · patch by 2026-05-29

Weakness / dates

CWE-266

Published 2026-05-21 · modified 2026-07-23

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	H	High

Timeline

2026-05-21 — Published (NVD)
2026-05-26 — Added to CISA KEV (actively exploited)
2026-05-29 — CISA patch-by deadline
2026-07-23 — Last modified (NVD)

Description

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

Affected

litespeedtech

References

Official: NVD · CVE.org