CVE-2026-48172 privilege escalation flaw in LiteSpeed cPanel plugin now under active exploitation
- CISA added CVE-2026-48172 to Known Exploited Vulnerabilities catalog based on evidence of active attacks
- Vulnerability affects LiteSpeed cPanel plugin and allows privilege escalation
- Federal agencies required to remediate by binding directive, private organisations strongly urged to patch
The Cybersecurity and Infrastructure Security Agency has added a privilege escalation vulnerability in the LiteSpeed cPanel plugin to its Known Exploited Vulnerabilities catalog, citing evidence that attackers are actively exploiting the flaw.
CVE-2026-48172 affects the LiteSpeed cPanel plugin and allows attackers to escalate privileges within affected systems. CISA’s advisory describes this type of vulnerability as a frequent attack vector used by malicious cyber actors.
The addition to the catalog triggers mandatory remediation requirements for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01. This directive established the KEV catalog as a living list of vulnerabilities that pose significant risks to federal networks.
CISA describes privilege escalation vulnerabilities as posing significant risks to the federal enterprise. The agency continues to monitor for evidence of active exploitation when determining which vulnerabilities to add to its catalog.
While the binding directive only applies to federal agencies, CISA strongly recommends that all organisations prioritise remediation of KEV catalog vulnerabilities as part of their standard vulnerability management practices.
The Known Exploited Vulnerabilities catalog serves as a centralised resource for tracking CVEs with confirmed evidence of exploitation in the wild. CISA updates the catalog based on specific criteria including proof of active exploitation and potential impact to critical infrastructure.
Why It Matters
This addition to the KEV catalog signals that attackers are actively targeting LiteSpeed cPanel environments. For CISOs, this represents an immediate operational risk requiring swift assessment and remediation across web hosting infrastructure. The privilege escalation nature of CVE-2026-48172 means successful exploitation could provide attackers with elevated system access.
Beyond immediate technical risks, the KEV listing creates regulatory pressure. While only binding for federal agencies, many compliance frameworks and security standards reference CISA’s KEV catalog as a baseline for critical vulnerability management.
What To Do Now
- Identify all LiteSpeed cPanel plugin installations across your environment and assess exposure to CVE-2026-48172
- Review CISA’s advisory for additional technical details and remediation guidance
- Prioritise patching of affected systems given confirmed active exploitation
- Monitor the KEV catalog regularly for new additions that may affect your infrastructure
