CVE-2026-48172

What it actually does

CVE-2026-48172 is a high-severity privilege escalation flaw in the LiteSpeed User-End cPanel/WHM Plugin related to mishandling of Redis enable/disable functionality. An attacker can abuse the affected Redis management path, specifically requests involving cpanel_jsonapi_func=redisAble, to perform actions with privileges beyond those intended for the requester, potentially escalating to root-level control on the hosting server. Because the CVSS vector indicates network exploitation, low complexity, no privileges, and no user interaction, exposed affected installations should be treated as remotely exploitable and high risk.

Why it matters to the business

Successful exploitation can allow an attacker to take over a shared hosting server, alter hosted websites, access customer data, deploy malware or web shells, disrupt hosted services, and pivot into other administrative functions. This issue is in CISA KEV, has been exploited in the wild since May 2026, and had a CISA remediation deadline of 2026-05-29, so unpatched systems represent a known exploited exposure rather than a theoretical risk.

How an attack unfolds

An attacker identifies a server running a vulnerable LiteSpeed cPanel or WHM plugin version. They send crafted requests to the plugin’s cPanel JSON API flow that invoke the Redis enable/disable functionality, including cpanel_jsonapi_func=redisAble. Due to improper handling of that functionality, the attacker can cause privileged operations to be executed outside the expected authorization boundary. If successful, the attacker may gain elevated control over the hosting account or server, possibly up to root, then use that access to modify files, create persistence, deploy web shells, access hosted site data, or manipulate system and service configuration. Public reporting indicates exploitation occurred in the wild in May 2026, so defenders should assume internet-facing vulnerable systems may have been targeted.

How to fix it

Upgrade the LiteSpeed User-End cPanel/WHM Plugin to at least version 2.4.7, the recommended minimum version. Do not rely on versions earlier than 2.4.5, and prefer 2.4.7 or later where available. If immediate upgrade is not possible, restrict access to cPanel/WHM interfaces to trusted administrative networks, disable or remove the affected plugin where operationally feasible, review Redis-related plugin functionality, and apply compensating web-layer controls that block suspicious requests containing cpanel_jsonapi_func=redisAble until patching is complete. Because this vulnerability is listed in CISA KEV and has been exploited in the wild, remediation should be treated as urgent and completed ahead of normal patch cycles.

How to confirm the fix worked

Confirm the installed LiteSpeed cPanel/WHM Plugin version is 2.4.7 or later using the server’s plugin/package management interface or file metadata. Verify the vulnerable plugin is no longer present on any cPanel/WHM systems or that access to it is restricted. Search historical cPanel logs for exploitation attempts using: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null. No output from that command indicates the vendor-described log artifact was not found; output should be treated as evidence of attempted or successful exploitation requiring investigation. After upgrading, repeat the search, review recent access logs for the same pattern, and test that unauthenticated or unauthorized users cannot invoke Redis enable/disable plugin functionality.

Typical attack path

1. Scan for internet-facing cPanel/WHM servers using the LiteSpeed User-End cPanel or WHM Plugin.
2. Determine whether the plugin is vulnerable by version or by probing exposed plugin/API behavior.
3. Send crafted cPanel JSON API requests involving cpanel_jsonapi_func=redisAble to abuse Redis enable/disable handling.
4. Trigger unauthorized privileged actions through the plugin’s Redis management logic.
5. Escalate privileges on the server, potentially to root-level control.
6. Modify hosted content, create new files or users, deploy web shells, exfiltrate data, or establish persistence.
7. Attempt to hide activity by blending into web/cPanel access logs or removing artifacts where possible.

How to detect it

Start with cPanel log review using the vendor-recommended search: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null. Relevant log sources include /var/cpanel/logs, /usr/local/cpanel/logs, cPanel access logs, web server access logs, LiteSpeed logs, authentication logs, sudo logs, shell history, cron directories, user creation/change logs, and file integrity monitoring alerts for hosted web roots. For any hit on cpanel_jsonapi_func=redisAble, pivot on the source IP, timestamp, authenticated user if present, user-agent, session identifier, and requested path. Determine whether the source IP is expected administrative infrastructure; unexpected, malformed, anonymized, or foreign source addresses should be treated as suspicious. After identifying candidate exploitation, examine nearby system activity for privilege escalation, new accounts, modified SSH authorized_keys files, new cron jobs, unexpected Redis configuration changes, newly created PHP or script files in web-accessible directories, and suspicious commands executed by cPanel, web server, or root-owned processes. Because exploitation was observed in the wild, absence of a single indicator should not end the investigation if the server was vulnerable and exposed; correlate log retention gaps, rotated logs, and host-level artifacts.

• cpanel_jsonapi_func=redisAble
• /var/cpanel/logs
• /usr/local/cpanel/logs/
• grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null
• redisAble

What your security team should do

• Immediately inventory all cPanel/WHM servers running the LiteSpeed cPanel or WHM Plugin and identify versions below 2.4.7.
• Patch or upgrade affected systems to LiteSpeed cPanel/WHM Plugin version 2.4.7 or later as the top priority.
• Run the recommended retrospective log search for cpanel_jsonapi_func=redisAble across /var/cpanel/logs and /usr/local/cpanel/logs on every affected server.
• For any matching log entries, extract source IP addresses, timestamps, requested URLs, user context, and response status, then investigate associated system, authentication, web, and shell activity.
• Temporarily restrict cPanel/WHM access to trusted IP ranges and block requests containing cpanel_jsonapi_func=redisAble at the WAF or reverse proxy where practical.
• Review affected hosts for post-exploitation artifacts such as new privileged users, modified cron jobs, unexpected SSH keys, changed hosted site files, web shells, and suspicious root-owned files.
• Because this vulnerability is in CISA KEV and actively exploited, treat any unpatched internet-facing instance as potentially compromised until logs and host artifacts are reviewed.