CISA Warns of Another Actively Exploited cPanel Plugin Flaw

CISA has added CVE-2026-54420 — a missing-authentication flaw in the LiteSpeed cPanel user-end plugin that enables elevated command/script execution — to its Known Exploited Vulnerabilities list and issued a three-day federal patching directive; the vulnerability is actively exploited in the wild and poses high risk to multi-tenant hosting environments, prompting immediate patching, disabling the plugin if unpatched, and monitoring for compromise.