[KEV] CVE-2026-54420 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-54420 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-54420 is a UNIX symbolic link (symlink) following vulnerability in the LiteSpeed cPanel Plugin, affecting shared hosting environments running CloudLinux with CageFS enabled.

Technical Detail

The flaw allows a user who has obtained FTP access or web shell access on a shared hosting server to craft malicious symlinks that escape the CageFS container boundary, which is designed to isolate users from one another and from sensitive system files. By following these symlinks, an attacker can read or potentially write to files outside their intended filesystem scope, undermining the security guarantees of the CageFS isolation layer. The practical impact is unauthorized file access across tenant boundaries, which in a shared hosting context can expose configuration files, credentials, or other tenants' data, and may facilitate further privilege escalation depending on the files reachable.

Exploitation Status

CISA has confirmed active exploitation in the wild, having added this vulnerability to the Known Exploited Vulnerabilities catalog on June 15, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real attacks, not merely demonstrated in a controlled research setting. Shared hosting providers should treat this as an actively abused vulnerability requiring immediate response.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability as of the date of this briefing.

What To Do

Under CISA's Known Exploited Vulnerabilities binding directive (BOD 22-01), federal civilian agencies are required to patch this vulnerability or apply mitigations by the deadline associated with its June 15, 2026 KEV listing. All organizations running the LiteSpeed cPanel Plugin on shared hosting infrastructure with CloudLinux and CageFS should apply the vendor-supplied patch immediately. Until patching is complete, administrators should audit FTP account permissions and restrict web shell execution capabilities where possible. Detection efforts should focus on anomalous symlink creation activity within CageFS-managed directories, unexpected cross-user file access patterns in system logs, and FTP session activity that accesses paths outside expected user home directories. Confirm with LiteSpeed that the installed plugin version is not affected or has been remediated, and review any shared hosting tenants for signs of lateral file access.