Skip to content

CVE-2026-48172

is CVE-2026-48172real, exploitable, or a false positive? Here's the community ground truth.

☆ Watch
Critical · CVSS 9.8EPSS 1.2%CISA KEVCWE-266

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

References

NVD MITRE CVE.org CISA KEV

Published

Embed this verdict
TruePositive verdict for CVE-2026-48172
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-48172/badge.svg)](https://www.truepositive.app/cve/CVE-2026-48172)
HTML
<a href="https://www.truepositive.app/cve/CVE-2026-48172"><img src="https://www.truepositive.app/cve/CVE-2026-48172/badge.svg" alt="TruePositive verdict for CVE-2026-48172"></a>

Live badge — updates automatically as the community verdict changes.

Community ground truth

Community verdict

3 verdicts
Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

Pick your verdict — we'll save it right after a quick sign-in.

Community real-world severity: Critical (Critical 3) — CVSS base score 9.8

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

  • 0
    Field note · Hanna BergCurated

    LiteSpeed cPanel Plugin Privilege Escalation Vulnerability — LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges. Listed in the CISA KEV catalog (added 2026-05-26) — confirmed exploited in the wild, not theoretical. FIRST EPSS puts the chance of exploitation in the next 30 days at ~1%. Treat it as real and prioritize remediation over triage.

  • 0
    Remediation · Sam WhitakerCurated

    Required action for LiteSpeed cPanel Plugin: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA set a federal remediation due date of 2026-05-29. After patching, verify the vulnerable path is no longer reachable before closing the finding.