LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 — lsws.redisAble Local Privilege Escalation Exploited in the Wild

LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 (TL-2026-0565), also tracked as lsws.redisAble 0-day, is a critical-severity zero-day vulnerability scored CVSS 10, first published 2026-05-22. It has no confirmed attribution, affects LiteSpeed Technologies LiteSpeed User-End cPanel Plugin, references 1 CVE (CVE-2026-48172), maps to 27 MITRE ATT&CK techniques (T1003.008, T1005, T1021.004), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0565

Threat ID
TL-2026-0565
Also known as
lsws.redisAble 0-day, LiteSpeed cPanel User-End Plugin RCE-as-root
Severity
CRITICAL
CVSS
10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
ZERO_DAY
First published
2026-05-22
Last reviewed
2026-05-22
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
hosting, web-hosting, managed-service-providers, small-business, ecommerce, publishing, education
Target regions
Global
Detection rules
9
Indicators of compromise
15

CVE-2026-48172 is a critical (CVSS v4.0 10.0) privilege escalation 0-day in the LiteSpeed User-End cPanel Plugin v2.3 through v2.4.4 actively exploited at time of disclosure. The lsws.redisAble JSON-API endpoint mishandles Redis enable/disable operations, allowing any authenticated cPanel tenant to execute arbitrary scripts as root and pivot from a single shared-hosting account to full Linux server takeover.

How LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 works

LiteSpeed Technologies and the cPanel/WebPros team co-disclosed CVE-2026-48172 on May 21, 2026, after security researcher David Strydom reported active in-the-wild exploitation on May 19, 2026. The flaw lives in the user-end cPanel plugin shipped with the LiteSpeed Web Server (LSWS) management stack and is rooted in CWE-266 (Incorrect Privilege Assignment): the lsws.redisAble JSON-API function — reachable through cPanel''s cpanel_jsonapi_func=redisAble interface — does not enforce a privilege boundary between the unprivileged invoking cPanel user and the root-context helper that performs Redis enable/disable operations on behalf of the tenant. Because the helper is invoked through a setuid/SUID-style elevation path inside the LSWS plugin and accepts attacker-influenced parameters, a low-privileged cPanel tenant can coerce the daemon into executing arbitrary scripts with full root privileges on the underlying Linux host.

Exploitation requires only valid cPanel credentials, which makes the bug devastating in shared-hosting environments: a single compromised tenant account — purchased, brute-forced, phished, or simply rented as the attacker — yields full server compromise, cross-tenant data theft, persistent rootkit installation, mass website defacement, and pivot opportunities into the hosting provider''s management plane. Public reporting confirms exploitation occurred prior to vendor disclosure, classifying this as a true zero-day. LiteSpeed shipped cPanel plugin v2.4.6 / WHM plugin v5.3.0.0 on May 19, 2026 to remediate the immediate flaw, then released cPanel plugin v2.4.7 / WHM plugin v5.3.1.0 on May 21, 2026 after a comprehensive security review. cPanel''s May 19, 2026 automated security update went further: it forcibly uninstalled the vulnerable user-end plugin entirely from affected servers via /scripts/upcp --force, treating the user-end component as unsalvageable in its current form.

Defenders should treat any shared-hosting Linux server that ran the LiteSpeed User-End cPanel Plugin between v2.3 and v2.4.4 as potentially compromised and hunt aggressively. The publicly published triage command is: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ — any positive hit warrants full incident response on that host, including review of /var/log/secure, /root/.bash_history, cron and systemd unit changes, SSH authorized_keys across all home directories, and outbound connections from lsws / litespeed processes. Affected products: LiteSpeed User-End cPanel Plugin v2.3, v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4. Fixed in: cPanel plugin v2.4.5+, recommended v2.4.7 bundled with WHM plugin v5.3.1.0. The parent LiteSpeed WHM Plugin itself was not vulnerable; only the user-end tenant-facing component is affected.

MITRE ATT&CK techniques used in TL-2026-0565

Credential Access

T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow; T1552.001 Unsecured Credentials: Credentials In Files

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 Remote Services: SSH

Persistence

T1053.003 Scheduled Task/Job: Cron; T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1543.002 Create or Modify System Process: Systemd Service

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Discovery

T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Defense Evasion

T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1078 Valid Accounts; T1078.003 Valid Accounts: Local Accounts; T1133 External Remote Services

Impact

T1486 Data Encrypted for Impact; T1491.002 Defacement: External Defacement; T1496 Resource Hijacking

defense-impairment

T1685.006 Clear Linux or Mac System Logs

Affected products and versions in LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

  • LiteSpeed Technologies — LiteSpeed User-End cPanel Plugin
    Vulnerable versions: 2.3; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
    Fixed in: 2.4.5; 2.4.6; 2.4.7
  • LiteSpeed Technologies — LiteSpeed WHM Plugin
    Vulnerable versions: <5.3.0.0 (when bundled with vulnerable user-end plugin)
    Fixed in: 5.3.0.0; 5.3.1.0
  • cPanel / WebPros — cPanel & WHM (with LiteSpeed user-end plugin installed)
    Vulnerable versions: any cPanel version with LiteSpeed user-end plugin 2.3-2.4.4 installed prior to May 19, 2026 automated security update
    Fixed in: cPanel automated security update May 19, 2026 — forcibly uninstalls plugin

Remediation for LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

Patches

  • cPanel User-End Plugin v2.4.5 (initial fix)
  • cPanel User-End Plugin v2.4.6 with WHM Plugin v5.3.0.0 (May 19, 2026)
  • cPanel User-End Plugin v2.4.7 with WHM Plugin v5.3.1.0 (May 21, 2026 — recommended)
  • cPanel automated security update of May 19, 2026 — forcibly uninstalls vulnerable user-end plugin

Immediate actions

  • Run the triage grep across cPanel logs: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ — investigate any hit as a confirmed exploitation attempt
  • Uninstall the vulnerable user-end plugin immediately: /usr/local/lsws/admin/misc/lscmctl cpanelplugin --uninstall
  • Force the cPanel automated security update which removes the plugin: /scripts/upcp --force
  • Audit /root/.bash_history, /var/log/secure, cron jobs, systemd units, and ~/.ssh/authorized_keys for every home directory on any host that ran an affected plugin version
  • Rotate root credentials, API tokens, and reissue host SSH keys on any server with positive grep hits

Workarounds

  • Uninstall the LiteSpeed User-End cPanel Plugin entirely until WHM Plugin v5.3.1.0+ is deployed
  • Disable cPanel tenant access to LSWS Redis features via cPanel feature manager
  • Restrict cPanel JSON-API at the WAF/reverse-proxy layer to block requests containing cpanel_jsonapi_module=lsws and cpanel_jsonapi_func=redisAble

Longer-term hardening

  • Upgrade LiteSpeed WHM Plugin to v5.3.1.0 or later (which bundles cPanel user-end plugin v2.4.7)
  • Deploy host-based EDR/auditd rules to alert on root-privileged process spawning from lsws/litespeed daemons with arguments referencing redisAble or tenant-controlled paths
  • Restrict the cPanel JSON-API surface where possible and monitor lsws.redisAble invocations as a high-value detection target
  • Treat shared-hosting tenant accounts as untrusted in the threat model: review every setuid helper invoked from tenant context, not only LiteSpeed plugins
  • Subscribe to cPanel and LiteSpeed security advisories and gate hosting deployments on automated security update enablement

CVEs associated with LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

CVE-2026-48172

Weaknesses (CWE) in LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

CWE-266, CWE-269, CWE-250, CWE-78

Timeline of LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

  • LiteSpeed ships emergency patches: cPanel user-end plugin v2.4.6 and WHM plugin v5.3.0.0. cPanel/WebPros issues an automated security update that forcibly uninstalls the vulnerable user-end plugin via /scripts/upcp --force.
  • Security researcher David Strydom reports the lsws.redisAble privilege escalation vulnerability to LiteSpeed Technologies. Vendor confirms in-the-wild exploitation against shared-hosting customers.
  • CVE-2026-48172 assigned by the CVE Numbering Authority for the LiteSpeed User-End cPanel Plugin privilege escalation flaw (CWE-266).
  • LiteSpeed publicly discloses CVE-2026-48172 and ships cPanel plugin v2.4.7 and WHM plugin v5.3.1.0 following a comprehensive security review. CVSS v4.0 score set to 10.0. GitHub Advisory GHSA-fxrh-cwjh-m33v published.
  • Threadlinqs Intelligence Platform ingests CVE-2026-48172 as TL-2026-0565 and begins full-spectrum analysis including MITRE mapping, IOC extraction, and detection coverage.
  • Cyber Security News and other outlets publish detailed coverage describing the lsws.redisAble flaw as an actively-exploited 0-day enabling shared-hosting tenant-to-root takeover.
  • As of 2026-05-29, CVE-2026-48172 remains a live, actively-exploited concern: CISA added it to the KEV catalog on May 26, 2026 with a May 29 remediation deadline, confirming ongoing in-the-wild abuse of the LiteSpeed cPanel lsws.redisAble root escalation. Patches (v2.4.5+/WHM 5.3.1.0) and cPanel's forced auto-uninstall exist, but unpatched shared-hosting servers stay exploitable.

Sources cited for LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

Threats related to LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172

Detection coverage for TL-2026-0565

As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0565 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats