Affected Systems
LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. The vulnerability bypasses isolation controls including CageFS. OpenLiteSpeed status unknown; no matching update released as of September 15. LiteSpeed 6.4.0 RC1 status not confirmed by cPanel.
Exploitation Status
Exploitation status unknown. No public statement from cPanel or LiteSpeed confirms active exploitation. No CVE assigned. Technical details not disclosed. Third LiteSpeed root escalation flaw since May 2026; prior two (CVE-2026-48172, CVE-2026-54420) were actively exploited.
Business Impact
Shared hosting providers face critical risk: a single low-privilege tenant account can escalate to root, compromising all hosted sites and server infrastructure. No workaround provided. No indicators of compromise published. Auto-update delayed; manual intervention required. No CVSS score or CVE published as of September 15. Pattern of LiteSpeed root escalation flaws in 2026 increases likelihood of attacker interest.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update LiteSpeed Web Server Enterprise to version 6.3.7 using: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
- After forced update, restore automatic stable updates by running: touch /usr/local/lsws/autoupdate/follow_stable
- Review server logs for anomalous privilege escalation attempts or unauthorized file access outside CageFS boundaries, focusing on hosting account activity since early September
- Audit all shared hosting accounts for unexpected administrative actions, new SSH keys, modified system binaries, or altered configuration files in /etc and /usr/local/lsws
- If running LiteSpeed 6.4.0 RC1 or OpenLiteSpeed, contact LiteSpeed support for patch status and consider migrating to Enterprise 6.3.7 or isolating affected servers until clarity is provided