CVE-2026-54420
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 15, 2026
- US federal agencies must remediate it by Jun 18, 2026 (BOD 22-01)
- Attacked 13 days before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Jul 10, 2026 Jun 16, 2026 Jun 15, 2026 Jun 14, 2026 Jun 1, 2026
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| litespeedtech | litespeed cpanel plugin | < 2.4.8 |
| litespeedtech | litespeed whm plugin | < 5.3.2.0 |
Related articles
VulnerabilitiesFrom a parked domain to server root: the critical flaw in cPanel/WHM
CVE-2026-65643 is a critical flaw in cPanel/WHM allowing privilege escalation to root. Immediate updates are required to prevent server compromise.
APTCyberattack on Philippine Nuclear and Navy: ownCloud and WordPress Used as Attack Vector
On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam 31.58.209 . 241 exposing a Python SimpleHTTP directory on port 8000.
This product uses the NVD API but is not endorsed or certified by the NVD.