CVE Tools
Sign in

CVE-2026-54420

Published: Jun 14, 2026Updated: Jul 23, 2026 Sources: CVE List NVDCWE-61
8.5HIGH
NVD MITRE
EPSS Score
1.4%
Top 28.9%
CISA KEV
Active Exploitation
Since Jun 15, 2026
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
OpenVAS

Description

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

In plain language

AI Act now

CVE-2026-54420 is a serious symlink-handling flaw in the LiteSpeed cPanel plugin that is already being exploited on shared hosting servers—if you run it on CloudLinux/CageFS, you should update to the fixed versions immediately.

Executive summary

CVE-2026-54420 is a privilege escalation risk caused by symlink mishandling in the LiteSpeed cPanel plugin (before 2.4.8 as packaged in the LiteSpeed WHM PlugIn before 5.3.2.0); attackers with FTP or web shell access can leverage it to escalate privileges on shared hosting (CloudLinux/CageFS).

If affected, business impact
Root-level takeover of serverCustomer data exposureSite defacement or downtimeComplete operational disruption

What to do now

  1. Check whether you are running the LiteSpeed cPanel plugin (or the LiteSpeed WHM PlugIn bundle) on your shared hosting server with CloudLinux/CageFS.
  2. Verify your installed versions: LiteSpeed cPanel plugin must be 2.4.8 or later, or LiteSpeed WHM PlugIn must be 5.3.2.0 or later.
  3. Upgrade to the fixed release: LiteSpeed WHM PlugIn v5.3.2.0+ (includes cPanel PlugIn v2.4.8).
  4. If you cannot upgrade right away, disable the cPanel PlugIn for LiteSpeed as a temporary mitigation.
  5. Follow CISA’s triage/forensics guidance and ensure patching is completed by the CISA remediation due date (2026-06-18).
Patch / advisory Usually a quick update

CVSS Vector Breakdown

AV:NAC:HPR:LUI:NS:CC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:HAttack Complexity
High
PR:LPrivileges Required
Low
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-61

Affected Products

litespeedtech
commercialaka litespeed cache, litespeed web server, openlitespeed
litespeed cpanel pluginOn-prem
Networking Infrastructure / load-balancer-proxy
litespeed whm pluginOn-prem
Networking Infrastructure / load-balancer-proxy
LiteSpeed Technologies
commercial·USaka openlitespeed, litespeed web server
cPanel PluginOn-prem
Networking Infrastructure / load-balancer-proxy

Exploitability

CISA Known Exploited Vulnerability
Added to KEV:Jun 15, 2026
Remediation due:Jun 18, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Official Patch Available
Workaround Available
Is your org exposed to CVE-2026-54420?We can run the check for you — a free external exposure review, no install. Check my exposure

References

https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
litespeedtech.com
https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/
blog.litespeedtech.com
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-54420
cisa.gov
News mentions
6

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-54420 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows