CISA Adds LiteSpeed cPanel Plugin Vulnerability to KEV List Following Active Exploitation

CISA added CVE-2026-54420 — a LiteSpeed cPanel plugin symbolic link (symlink) handling vulnerability — to its Known Exploited Vulnerabilities catalog after evidence of active exploitation; the flaw can allow attackers with limited access (e.g., FTP credentials or web shells) to access sensitive files outside jailed directories in multi-tenant hosting, potentially enabling privilege escalation or data exposure. Organizations are urged to apply vendor mitigations, enforce secure file permissions, disable unsafe symlink behavior, monitor for suspicious access, and comply with BOD 26-04 remediation deadlines.