The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed vulnerability in the LiteSpeed cPanel plugin to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies just 72 hours to remediate the flaw across their networks.
The vulnerability, tracked as CVE-2026-54420, affects the user-end LiteSpeed plugin for cPanel, a widely deployed web hosting control panel used by shared hosting providers and enterprises worldwide. As first reported by BleepingComputer, the flaw is already being actively exploited in real-world attacks, prompting the unusually aggressive remediation timeline.
Under CISA's binding operational directives, all U.S. federal civilian agencies must apply patches or implement mitigations for KEV-listed vulnerabilities within the specified window. While the directives technically apply only to government bodies, the KEV catalog serves as a critical reference for the broader cybersecurity community, and many private-sector organisations use it to prioritise their own patching efforts.
Another cPanel plugin flaw under active exploitation
The advisory marks the latest in a series of cPanel plugin vulnerabilities that have drawn CISA's attention in recent months. The repeated targeting of cPanel-related components highlights the software's central role in web hosting infrastructure — and the interest attackers have in exploiting it.
cPanel serves as the management interface for millions of web servers globally, making it a high-value target. A successful exploit in a cPanel plugin could give attackers access to hosted websites, email accounts, databases, and potentially the underlying server itself. For hosting providers managing thousands of customer accounts on a single machine, the blast radius of such a compromise can be significant.
The LiteSpeed plugin integrates specifically with LiteSpeed Web Server, a high-performance alternative to Apache popular among hosting providers for its speed and efficiency. Full technical details of the vulnerability have not been disclosed — a common practice during active remediation to avoid handing attackers a roadmap.
Why this matters beyond federal agencies
The 72-hour remediation window is notably short, reflecting CISA's assessment that the risk of continued exploitation is high. Organisations running cPanel with the LiteSpeed plugin — whether in government, enterprise, or shared hosting environments — should treat this advisory as urgent.
Security teams are advised to:
- Verify whether their cPanel installations include the LiteSpeed plugin
- Apply vendor-provided patches as soon as they become available
- Monitor for indicators of compromise, particularly if patching cannot be completed immediately
- Review access logs for unusual activity on cPanel-managed servers
For Hong Kong-based hosting providers and IT teams managing web infrastructure, the advisory is a timely reminder that widely deployed server management tools remain attractive attack surfaces. While CISA's directives are U.S.-centric, vulnerabilities in software like cPanel are borderless, and threat actors typically do not confine their campaigns to a single jurisdiction.
The addition of CVE-2026-54420 to the KEV catalog brings the total number of actively exploited flaws CISA is tracking to well over a thousand — a figure that continues to grow as researchers and attackers alike probe critical infrastructure software for weaknesses.
美國網絡安全和基礎設施安全局（CISA）已將一個在LiteSpeed cPanel插件中新披露的漏洞，加入其「已知被利用漏洞」（KEV）目錄，並僅給予聯邦機構72小時，在其網絡內修補該缺陷。
此漏洞編號為 CVE-2026-54420，影響用於cPanel的用戶端LiteSpeed插件。cPanel是一個廣泛部署的網頁寄存控制面板，被全球共享寄存供應商和企業普遍採用。據BleepingComputer首先報導，該漏洞已在現實世界的攻擊中被積極利用，促使當局制定了異常緊迫的修補期限。
根據CISA具有約束力的運營指令，所有美國聯邦民用機構必須在指定期限內，對KEV目錄所列漏洞應用補丁或實施緩解措施。雖然這些指令在技術上僅適用於政府機構，但KEV目錄是更廣泛網絡安全社區的重要參考，許多私營機構也利用它來確定自身補丁工作的優先次序。
另一項cPanel插件漏洞遭積極利用
這份公告是近月來一系列引起CISA關注的cPanel插件漏洞中的最新一例。cPanel相關組件被反覆針對，凸顯了該軟件在網頁寄存基礎設施中的核心地位——以及攻擊者對其進行利用的興趣。
cPanel作為全球數百萬網頁伺服器的管理界面，使其成為高價值目標。成功利用cPanel插件中的漏洞，可能使攻擊者獲取對託管網站、電郵帳戶、數據庫，乃至底層伺服器本身的存取權限。對於在一臺機器上管理數千個客戶帳戶的寄存供應商而言，此類入侵的影響範圍可能相當巨大。
LiteSpeed插件專門與LiteSpeed網頁伺服器整合，這是一款高性能的Apache替代方案，因其速度和效率而深受寄存供應商歡迎。該漏洞的完整技術細節尚未披露——這是在積極修補期間的常見做法，以免向攻擊者提供路線圖。
為何這對聯邦機構以外的組織同樣重要
72小時的修補窗口期顯著偏短，反映了CISA對持續利用風險高的評估。運行帶有LiteSpeed插件的cPanel的組織——無論是政府、企業還是共享寄存環境——都應將此公告視為緊急事項。
建議安全團隊： - 驗證其cPanel安裝是否包含LiteSpeed插件 - 應用供應商提供的補丁，一旦其可用 - 監控入侵指標，特別是無法立即完成補丁時 - 審查cPanel管理伺服器的存取日誌，查找異常活動
對於香港的寄存供應商和管理網頁基礎設施的IT團隊而言，此公告是一個及時的提醒：廣泛部署的伺服器管理工具仍是具吸引力的攻擊面。雖然CISA的指令以美國為中心，但cPanel等軟件中的漏洞是無國界的，威脅行為者通常不會將其活動局限於單一管轄區。
CVE-2026-54420被加入KEV目錄，使CISA正在追蹤的遭積極利用漏洞總數遠超一千個——這個數字仍在持續增長，因為研究人員和攻擊者都在探查關鍵基礎設施軟件的弱點。