A vulnerability in the cPanel plugin tied to LiteSpeed Web Server is being watched as an active exploitation risk, with the main concern centered on attackers moving from limited access to higher privileges.
CISA moved fast on CVE-2026-54420, an actively exploited flaw in the LiteSpeed cPanel user-end plugin that can matter far beyond a single account.
CISA’s inclusion of CVE-2026-54420 in its exploited-vulnerability list shows how a hosting convenience add-on can turn into a high-priority escalation path.