Patch LiteSpeed cPanel Plugin for CVE‑2026‑54420: Step‑by‑Step Guide

Running a web server with the LiteSpeed cPanel plugin is convenient, but like any software it may contain bugs that could be exploited by a local user. The vulnerability identified as CVE‑2026‑54420 allows privilege escalation to the root account. The issue is resolved in the latest plugin release. This guide explains how to apply the patch safely on a typical cPanel/WHM server (AlmaLinux 8/9 or Rocky Linux 8/9) and why each command is required.

Scope of the vulnerability

• What it is: A flaw in the LiteSpeed cPanel plugin that could let a local user execute code with root privileges.
• Who is affected: Any server running the plugin on a cPanel/WHM installation, regardless of the hosted applications.
• Why patching matters: Even without exposing shell access to untrusted users, a compromised website or mis‑configured script could become a foothold.

The fix is delivered as a new version of the plugin. Updating replaces the vulnerable binaries and refreshes the associated configuration files.

Prepare the server

Before making changes, create a snapshot or backup so you can roll back if needed.

# Example: Create a backup with cPanel's built‑in tool
/scripts/backup --force

Schedule the update during a maintenance window to avoid impacting active customers.

Verify the current plugin version

Check the installed version to confirm whether an update is required.

# Show LiteSpeed plugin status and version
/usr/local/lsws/admin/misc/lswsctrl status

If the reported version is older than 5.4.12 (the version that includes the CVE‑2026‑54420 fix), proceed with the update.

Update the LiteSpeed cPanel plugin

AlmaLinux / Rocky Linux (dnf)

# Refresh package metadata and apply pending OS updates
dnf update -y

# Install or upgrade the LiteSpeed cPanel plugin package
dnf install -y lsws-whm

# Restart services so they load the new binaries
systemctl restart lsws
systemctl restart cpanel

Explanation

• dnf update -y – updates the package database and applies any pending operating‑system updates.
• dnf install -y lsws-whm – fetches the latest lsws-whm package from the LiteSpeed repository, overwriting the vulnerable files.
• systemctl restart lsws and systemctl restart cpanel – reload LiteSpeed and WHM so they run the updated code.

Debian / Ubuntu (apt)

# Refresh the local package index
apt update

# Install or upgrade the LiteSpeed plugin package
apt install -y lsws-whm

# Restart services to load the new binaries
systemctl restart lsws
systemctl restart cpanel

Explanation

• apt update – updates the local package index.
• apt install -y lsws-whm – installs or upgrades the LiteSpeed plugin from the configured repository.
• The systemctl restart commands perform the same function as in the dnf block.

Verify the patch

After restarting, confirm that the plugin reports a patched version.

# Check the version again
/usr/local/lsws/admin/misc/lswsctrl status

The output should show version 5.4.12 or newer. You can also query the installed package directly:

# For dnf‑based systems
dnf info lsws-whm

# For apt‑based systems
apt list --installed lsws-whm

Return services to normal

If you stopped any services for maintenance, start them again.

# Example: restart common services
systemctl start httpd   # Apache, if used alongside LiteSpeed
systemctl start mysql   # MySQL/MariaDB

Review logs for any signs of attempted exploitation before the patch was applied.

# Look for privilege‑escalation attempts
grep -i "sudo" /var/log/secure
grep -i "lsws" /usr/local/lsws/logs/error.log

Ongoing maintenance recommendations

• Enable automatic security updates for the OS and LiteSpeed (dnf‑automatic or unattended‑upgrades).
• Subscribe to the LiteSpeed security mailing list for future CVE notifications.
• Run regular vulnerability scans (e.g., lynis or OpenVAS) to detect missing patches.
• Apply the principle of least privilege to all shell users and restrict SSH access to trusted IPs.

Conclusion

Local root privilege escalation is a serious risk, but applying the official LiteSpeed cPanel plugin update removes CVE‑2026‑54420 from your server. By backing up, checking the current version, installing the patched package, and confirming the update, you can secure your hosting environment without downtime. Remember that security is an ongoing process: keep the OS, cPanel, and LiteSpeed components up to date and stay informed about new advisories.