cPanel warns a single hosting account can take root on unpatched LiteSpeed Enterprise servers
cPanel's September 14 advisory covers every LiteSpeed Web Server Enterprise build before 6.3.7. The fix shipped on September 11; because auto-update may lag, administrators have to force it onto servers by hand.
The Watch · Security desk
What happened
- cPanel published an advisory on September 14 saying a low-privilege website user on a shared server running LiteSpeed Web Server Enterprise could gain root access on that machine.
- The flaw bypasses the controls that keep hosting accounts apart, including CloudLinux's CageFS, which normally limits each account to a restricted view of the file system.
- LiteSpeed published the fixed release, 6.3.7, on September 11; every earlier Enterprise build is affected, and cPanel told administrators to update to it.
- cPanel did not assign a CVE identifier or severity score, or say whether the flaw has been exploited; a check of published CVE records on September 15 turned up no entry.
- This is the third LiteSpeed root-escalation flaw reported on cPanel servers since May, and the first one in the web server rather than in LiteSpeed's cPanel plugin.
Why it matters
- Who's exposed exposure On an unpatched machine the separation customers are paying for is what fails: one hosting account becomes a route to every other site on the box and to the server's own configuration.
- What it limits constraint Patching now pins the server to 6.3.7 and takes it off its stable update tier, so whoever runs the emergency update also owns the follow-up job of switching automatic updates back on.
- Who has to decide decision No workaround has been published and there are no indicators to hunt against, so an operator who cannot take an immediate update window is choosing between running exposed and taking customer sites down.
- What it sets up precedent Shipping a root-escalation fix inside an unattributed changelog, with no identifier attached, sets the terms for the next one: fleet-wide forced installs with nothing to triage against.
Next story · Security · 3d ago
SAP patches a maximum-severity Python SDK flaw that redirects OAuth2 token requests through tenant_subdomainConfirmed4 publishers
The 6.3.7 changelog lists three security changes, and neither cPanel nor LiteSpeed has said which one closes the root path [8]. LiteSpeed's announcement of the release described it as a build with "Security improvements, bug fixes, and more!" [7]. cPanel's advisory does not describe how the flaw works [6]. That leaves an administrator one step: the install.
Three days separated the fix and the advisory [20]. The update may not arrive on its own: LiteSpeed said there "may be some delay" before the release reaches auto-update [11], and both companies publish the same forced-version command, /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7 [10]. Four days after 6.3.7 shipped, LiteSpeed's own download page still listed 6.3.6 as the stable release [21].
That command has a side effect. LiteSpeed's update documentation says forcing a specific version stops the server following its stable update tier, and that automatic stable updates resume after running touch /usr/local/lsws/autoupdate/follow_stable [14]. A fleet patched in a hurry and never un-pinned sits on 6.3.7 and does not pick up later stable builds.
The advisory covers the Enterprise edition only. It leaves out OpenLiteSpeed, the open-source server, and LiteSpeed had released no matching update for it as of September 15 [16]. The July release candidate for 6.4.0 sits outside the advisory too: its changelog omits the three security changes, and cPanel is silent on whether the release candidates are affected [12][13].
The two earlier root paths were both in LiteSpeed's user-end cPanel plugin. LiteSpeed disclosed CVE-2026-48172 in May and CVE-2026-54420 in June, said both were being actively exploited, and fixed both in the plugin; CISA later added both to its Known Exploited Vulnerabilities catalog [18]. This one is in the web server that answers the requests [17]. The Hacker News said it has contacted LiteSpeed, cPanel and CloudLinux with questions about the flaw [19].
What to watch
- A CVE assignment or a KEV entry for this flaw, either of which would put a dated deadline on the update.
- Whether LiteSpeed promotes 6.3.7 to stable on its download page, removing the need for the forced install.
- Any statement from LiteSpeed on whether the 6.4.0 release candidates and OpenLiteSpeed share the affected code.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14.
- [2]
On such servers many customers' sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself, according to the cPanel advisory.
- [3]
The flaw affects versions before 6.3.7, and cPanel urged administrators to update to that release, which LiteSpeed published on September 11.
- [4]
The flaw can bypass the controls that keep hosting accounts apart, including CageFS, cPanel said.
- [5]
CageFS is a CloudLinux tool that gives each hosting account a restricted view of the file system, so it cannot see other accounts or the server's configuration files.
- [6]
Neither cPanel's advisory nor LiteSpeed's release notes describe how the flaw works.
- [7]
LiteSpeed's announcement of 6.3.7 called it a release with "Security improvements, bug fixes, and more!"
- [8]
LiteSpeed's changelog for 6.3.7 lists three security changes but does not mention a privilege-escalation flaw, and neither company has said publicly which change fixes it.
- [9]
The advisory carries no CVE identifier or severity score, a check of published CVE records on September 15 found none for the flaw, and the advisory does not say whether the flaw has been exploited.
- [10]
Both cPanel and LiteSpeed give the same command to install 6.3.7 now: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
- [11]
LiteSpeed said there "may be some delay" before the 6.3.7 release reaches auto-update.
- [12]
As of September 15, LiteSpeed's download page still listed 6.3.6 as the stable release, alongside a July pre-release build of 6.4.0 (RC1) whose changelog does not list the three security changes.
- [13]
cPanel's advisory does not say whether the 6.4.0 release candidates are affected.
- [14]
LiteSpeed's update documentation says that forcing a specific version with that command stops the server from following its stable update tier, and that administrators can resume automatic stable updates afterward by running touch /usr/local/lsws/autoupdate/follow_stable.
- [15]
Neither cPanel's advisory nor LiteSpeed's release notes offer a workaround for servers that cannot update at once, or indicators for checking whether a server has already been attacked.
- [16]
The advisory names only the Enterprise edition and does not address OpenLiteSpeed, LiteSpeed's open-source server, for which LiteSpeed had released no matching update as of September 15.
- [17]
It is the third time since May that a flaw in LiteSpeed software on cPanel servers has been reported to grant a hosting account root access, but the first in the web server itself.
- [18]
In May and June, LiteSpeed disclosed two such flaws in its user-end cPanel plugin, CVE-2026-48172 and CVE-2026-54420, said both were being actively exploited, and fixed both in the plugin; CISA later added both to its Known Exploited Vulnerabilities catalog.
- [19]
The Hacker News said it has contacted LiteSpeed, cPanel, and CloudLinux with questions about the flaw.
- [20]
Three days separated LiteSpeed's publication of 6.3.7 on September 11 and cPanel's advisory on September 14.
- [21]
Four days after 6.3.7 was published, LiteSpeed's download page still listed 6.3.6 as the stable release.
Sources
2 independent publishers whose own reporting we read for this story.
- securityaffairs.comShared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant
1 article · September 15, 2026
- thehackernews.comLiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
2 articles · September 15, 2026
Topics and entities
Topics
- Shared hosting security
- Privilege Escalation
- Patch And Redeploy Latency
Entities
- CISA Known Exploited Vulnerabilities Catalog
- cPanel
- LiteSpeed Web Server Enterprise
- CISA