cPanel warned on September 14 that a critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server.
cPanel advisory (September 14): scope, risk, and limits of the notice
According to cPanel's advisory published September 14, the flaw affects LiteSpeed Web Server Enterprise versions before 6.3.7 and could allow an attacker who controls a single hosting account on a shared server to access or alter other sites and the server itself. The advisory says the flaw can bypass controls that keep hosting accounts apart, including CageFS. cPanel did not provide a CVE identifier, a severity score, or any indicators of compromise, and the advisory does not say whether the flaw has been exploited.
What LiteSpeed published (6.3.7) and what remains unspoken
LiteSpeed published release 6.3.7 on September 11. Its announcement described the release as containing "Security improvements, bug fixes, and more!" and the changelog lists three unspecified security changes. Neither the LiteSpeed release notes nor cPanel's advisory describe the technical mechanism of the flaw, and neither company has said publicly which of the changes in 6.3.7 addresses the issue. As of September 15, LiteSpeed's download page still listed 6.3.6 as the stable release and showed a July pre-release build of 6.4.0 (RC1) whose changelog does not list the three security changes; cPanel's advisory does not say whether the 6.4.0 release candidates are affected.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow administrators are told to update, and why manual installs matter
Both cPanel and LiteSpeed provide the same command for installing 6.3.7: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7. The advisory emphasizes a manual update because LiteSpeed warned there "may be some delay" before 6.3.7 reaches automatic updates. LiteSpeed's update documentation notes that forcing a specific version with that command stops the server from following the stable update tier; administrators can resume automatic stable updates afterward by running touch /usr/local/lsws/autoupdate/follow_stable. cPanel and LiteSpeed have not published a workaround for servers that cannot update immediately, nor have they provided indicators administrators could use to check whether a server has already been attacked.
CageFS, shared hosting, and how a single account becomes an elevated risk
cPanel's advisory highlights the shared-hosting model as the critical operational context: many customers' sites run on a single machine, and an attacker who compromises one hosting account could leverage this flaw to reach other accounts or the server itself. CageFS, a CloudLinux tool referenced in the advisory, is intended to give each hosting account a restricted view of the file system so it cannot see other accounts or server configuration files; cPanel says the LiteSpeed flaw can bypass those controls. The advisory names only the Enterprise edition; it does not address OpenLiteSpeed, and LiteSpeed had released no matching update for OpenLiteSpeed as of September 15.
Prior related flaws: CVE-2026-48172 and CVE-2026-54420
cPanel and LiteSpeed are confronting this problem for a third time since May in the sense that this is the third reported flaw in LiteSpeed software on cPanel servers that can grant a hosting account root access — but it is the first reported privilege-escalation flaw in the web server itself. In May and June, LiteSpeed disclosed two flaws in its user-end cPanel plugin, CVE-2026-48172 and CVE-2026-54420; LiteSpeed said both were being actively exploited and fixed them in the plugin. CISA later added both plugin CVEs to its Known Exploited Vulnerabilities catalog, and The Hacker News reported those developments in May and June.
The Hacker News has contacted LiteSpeed, cPanel, and CloudLinux with questions.
This advisory leaves two concrete gaps in the public record: no CVE or severity score had been published as of September 15, and neither vendor has said whether the flaw has been observed in the wild. Administrators running shared hosting with LiteSpeed Web Server Enterprise now have a clear, vendor-published install command to apply 6.3.7, but the record shows that release metadata and automatic-update timing still leave operational discretion and risk on the table.
