Answer in brief
CVE-2026-48172 records a High severity vulnerability in CISA ADP Vulnrichment. The current sources mark it as known exploited. The current feed maps LiteSpeed Technologies/cPanel Plugin (generic), LiteSpeed Technologies/WHM Plugin (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps LiteSpeed Technologies/cPanel Plugin (generic), LiteSpeed Technologies/WHM Plugin (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| LiteSpeed Technologies/cPanel Plugingeneric | >=2.3 <2.4.7 | 2.4.7 |
| LiteSpeed Technologies/WHM Plugingeneric | >=0 <5.3.1.0 | 5.3.1.0 |
Published upstream
May 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
May 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
May 26, 2026
Added to CISA KEV
May 26, 2026
Evidence: source:kev:kev:kev:recordLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-48172 records a High severity vulnerability in CISA ADP Vulnrichment. The current sources mark it as known exploited. The current feed maps LiteSpeed Technologies/cPanel Plugin (generic), LiteSpeed Technologies/WHM Plugin (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps LiteSpeed Technologies/cPanel Plugin (generic), LiteSpeed Technologies/WHM Plugin (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| LiteSpeed Technologies/cPanel Plugingeneric | >=2.3 <2.4.7 | 2.4.7 |
| LiteSpeed Technologies/WHM Plugingeneric | >=0 <5.3.1.0 | 5.3.1.0 |
Published upstream
May 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
May 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
May 26, 2026
Added to CISA KEV
May 26, 2026
Evidence: source:kev:kev:kev:recordLiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
Quoted source text, attributed separately from HOL analysis.