CISA Adds LiteSpeed cPanel Plugin Bug to KEV After In-the-Wild Exploitation

CISA has added a high-severity privilege escalation flaw in the LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities catalog, tagging it as actively abused in the wild.

The bug is tracked as CVE-2026-54420, CVSS 8.5. It's a privilege escalation issue in the plugin's handling of user-controlled input, and successful exploitation gives an attacker root on the underlying host (a meaningful outcome on multi-tenant cPanel boxes, where one rooted node can mean dozens or hundreds of compromised customer sites).

Federal Civilian Executive Branch agencies have until June 18, 2026 to apply the fix under BOD 22-01. Private operators should not read that deadline as breathing room.

Why this one matters operationally: the LiteSpeed cPanel plugin is bundled across a large slice of shared hosting and reseller environments. cPanel deployments are notoriously slow to patch because the plugin layer sits between the panel, the web server, and tenant accounts, and upgrades are often deferred to scheduled maintenance windows. Attackers know that.

CISA has not published technical specifics on how the bug is being exploited, and there is no public exploit writeup attributing the discovery to a named researcher at time of writing. The KEV listing itself is the disclosure that matters here — once a CVE lands on KEV, the assumption is that working exploitation already exists outside controlled research.

What to do

If you run LiteSpeed Web Server with the cPanel plugin:

• Update the plugin to the latest fixed release via cPanel's plugin manager or the LiteSpeed-supplied installer script. Confirm the version string after upgrade; the plugin has historically had separate update channels for the WHM-integrated build and the standalone build.
• Audit lsws and plugin directories for unexpected setuid binaries, modified wrapper scripts, or out-of-place cron entries. Root-level persistence is the obvious post-exploit play.
• Review web server and panel logs for anomalous plugin-triggered actions in the weeks preceding patch. CISA's listing implies exploitation predates the catalog entry.
• Rotate API tokens and panel credentials on any host where compromise can't be ruled out.

For hosting providers, the calculus is harder. A rooted cPanel node means tenant data, SSH keys, and TLS private keys on that box should be treated as exposed. Reissue, don't just rotate.

Context

This is the second cPanel-ecosystem flaw to draw federal-level attention in recent memory, and the pattern is familiar: shared hosting infrastructure remains a high-value target because a single bug yields fan-out across thousands of downstream sites. Defenders running this stack should treat plugin updates with the same urgency they reserve for the panel itself.

LiteSpeed Technologies has not, as of publication, posted a standalone security advisory page for CVE-2026-54420 beyond the patched release notes. Expect that to change.