# LiteSpeed User-End cPanel Plugin 0-Day CVE-2026-48172 — lsws.redisAble Local Privilege Escalation Exploited in the Wild

> CVE-2026-48172 is a critical (CVSS v4.0 10.0) privilege escalation 0-day in the LiteSpeed User-End cPanel Plugin v2.3 through v2.4.4 actively exploited at time of disclosure. The lsws.redisAble JSON-API endpoint mishandles Redis enable/disable operations, allowing any authenticated cPanel tenant to execute arbitrary scripts as root and pivot from a single shared-hosting account to full Linux server takeover.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0565
- **ID:** TL-2026-0565
- **Severity:** CRITICAL (CVSS 10)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48172

## Description

LiteSpeed Technologies and the cPanel/WebPros team co-disclosed CVE-2026-48172 on May 21, 2026, after security researcher David Strydom reported active in-the-wild exploitation on May 19, 2026. The flaw lives in the user-end cPanel plugin shipped with the LiteSpeed Web Server (LSWS) management stack and is rooted in CWE-266 (Incorrect Privilege Assignment): the lsws.redisAble JSON-API function — reachable through cPanel''s cpanel_jsonapi_func=redisAble interface — does not enforce a privilege boundary between the unprivileged invoking cPanel user and the root-context helper that performs Redis enable/disable operations on behalf of the tenant. Because the helper is invoked through a setuid/SUID-style elevation path inside the LSWS plugin and accepts attacker-influenced parameters, a low-privileged cPanel tenant can coerce the daemon into executing arbitrary scripts with full root privileges on the underlying Linux host.

Exploitation requires only valid cPanel credentials, which makes the bug devastating in shared-hosting environments: a single compromised tenant account — purchased, brute-forced, phished, or simply rented as the attacker — yields full server compromise, cross-tenant data theft, persistent rootkit installation, mass website defacement, and pivot opportunities into the hosting provider''s management plane. Public reporting confirms exploitation occurred prior to vendor disclosure, classifying this as a true zero-day. LiteSpeed shipped cPanel plugin v2.4.6 / WHM plugin v5.3.0.0 on May 19, 2026 to remediate the immediate flaw, then released cPanel plugin v2.4.7 / WHM plugin v5.3.1.0 on May 21, 2026 after a comprehensive security review. cPanel''s May 19, 2026 automated security update went further: it forcibly uninstalled the vulnerable user-end plugin entirely from affected servers via /scripts/upcp --force, treating the user-end component as unsalvageable in its current form.

Defenders should treat any shared-hosting Linux server that ran the LiteSpeed User-End cPanel Plugin between v2.3 and v2.4.4 as potentially compromised and hunt aggressively. The publicly published triage command is: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ — any positive hit warrants full incident response on that host, including review of /var/log/secure, /root/.bash_history, cron and systemd unit changes, SSH authorized_keys across all home directories, and outbound connections from lsws / litespeed processes. Affected products: LiteSpeed User-End cPanel Plugin v2.3, v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4. Fixed in: cPanel plugin v2.4.5+, recommended v2.4.7 bundled with WHM plugin v5.3.1.0. The parent LiteSpeed WHM Plugin itself was not vulnerable; only the user-end tenant-facing component is affected.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1211 Exploitation for Stealth
- T1685.006 Clear Linux or Mac System Logs
- T1070.004 Indicator Removal: File Deletion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1069 Permission Groups Discovery
- T1136.001 Create Account: Local Account
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1053.003 Scheduled Task/Job: Cron
- T1543.002 Create or Modify System Process: Systemd Service
- T1021.004 Remote Services: SSH
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1496 Resource Hijacking
- T1486 Data Encrypted for Impact
- T1491.002 Defacement: External Defacement

## Sources

- [Cyber Security News: LiteSpeed cPanel Plugin 0-Day Exploited in the wild to Gain Server Root Access](https://cybersecuritynews.com/litespeed-cpanel-plugin-0-day-exploited/)
- [GitHub Advisory Database — GHSA-fxrh-cwjh-m33v (CVE-2026-48172)](https://github.com/advisories/GHSA-fxrh-cwjh-m33v)
- [TheHackerWire — CVE-2026-48172 Info Vulnerability](https://www.thehackerwire.com/vulnerability/CVE-2026-48172/)
- [THREATINT — CVE-2026-48172](https://cve.threatint.eu/CVE/CVE-2026-48172)
- [Gotekky — LiteSpeed User-End cPanel Plugin Privilege Escalation: The Actively-Exploited Bug That Got Auto-Uninstalled in cPanel''s May 19, 2026 Emergency Patch](https://www.gotekky.com/guides/security/litespeed-user-end-cpanel-plugin-privilege-escalation-2026/)
- [LiteSpeed Technologies — Security Update Announcement (blog)](https://blog.litespeedtech.com/)
- [MITRE CVE — CVE-2026-48172](https://www.cve.org/CVERecord?id=CVE-2026-48172)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0565