CVE-2026-48172
CISA 기관 조치 기한: 2026-05-29
LiteSpeed cPanel Plugin
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
KEV 필수 조치: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
타임라인
- NVD 공개
- CISA KEV 등재(실제 악용 확인) 공개 후 5일
- CISA 기관 조치 기한 경과
- 첫 보도 The Hacker News · 치명적인 cPanel 결함으로 인해 한 호스팅 고객이 전체 서버를 …
- 최근 보도 (총 2건) The Hacker News · LiteSpeed Enterprise의 취약점으로 인해 단일 호스팅 계정이 …
날짜 정보 없는 신호: 공개 PoC 3건
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
공개 익스플로잇 / PoC
- GitHub 공개 PoC 3건 — 대표 레포 ↗