CVE-2026-48172 Elastic Security · Elastic

Detect LiteSpeed cPanel Plugin Privilege Escalation (CVE-2026-48172) in Elastic Security

Detects exploitation of CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin (CWE-266: Incorrect Privilege Assignment). Attackers with low-privileged cPanel access can leverage the plugin's improper privilege handling to elevate to root or administrative system access. This vulnerability is actively exploited in the wild (CISA KEV).

MITRE ATT&CK

Tactic
Privilege Escalation Persistence Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where process.name in ("lshttpd", "lsphp", "lsws_cpanel", "litespeed") and
   (process.args : ("*uid=0*", "*euid=0*", "*suid*") or
    process.executable : ("/usr/local/lsws/*", "/opt/litespeed/*"))]
  [process where process.user.id == "0" and
   process.parent.name in ("lshttpd", "lsphp", "lsws_cpanel", "litespeed",
                           "bash", "sh", "dash") and
   process.name in ("chmod", "chown", "usermod", "visudo", "su", "sudo", "passwd")]
critical severity high confidence

EQL sequence detection: LiteSpeed process followed within 5 minutes by a root-context privilege modification command spawned from a LiteSpeed or shell parent. Indicates privilege escalation chain consistent with CVE-2026-48172.

Data Sources

Endpoint Process LogsAuditbeatElastic Agent

Required Tables

logs-endpoint.events.process-*auditbeat-*

False Positives & Tuning

  • Authorized LiteSpeed plugin updates run interactively by root administrators
  • Automated WHM tasks that chain LiteSpeed management with system user changes
  • Security tools that exec from LiteSpeed process space during audits

Other platforms for CVE-2026-48172

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate LiteSpeed Plugin Privilege Escalation via SUID Binary Invocation

    Expected signal: Process creation event for /tmp/lsphp with SUID bit set; child process reporting uid=0 or euid=0 in execve audit record.

  2. Test 2LiteSpeed Parent Process Spawning usermod Command

    Expected signal: SecurityEvent/audit log showing useradd/usermod syscall with uid=0, parent process traceable to a litespeed-named process or shell.

  3. Test 3Unauthorized sudoers Entry via LiteSpeed Process Context

    Expected signal: File write to /etc/sudoers.d/ captured in Linux audit log (auditd WRITE syscall on path /etc/sudoers.d/litespeed_test) with triggering process running as UID 0.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host(s) by correlating process telemetry for lshttpd, lsphp, or lsws_cpanel with UID-0 transitions. Confirm the LiteSpeed cPanel Plugin version installed via `rpm -qa | grep -i litespeed` or `/usr/local/lsws/bin/lshttpd -v`.
  2. Check cPanel WHM audit log (`/usr/local/cpanel/logs/`) and LiteSpeed error logs (`/usr/local/lsws/logs/error.log`) for anomalous plugin API calls or unexpected privilege grants around the alert timestamp.
  3. Determine the user account context at the time of the event: was the triggering user a low-privileged cPanel reseller or end-user? Privilege escalation from such an account is a strong indicator of exploitation.
  4. Review `/etc/passwd`, `/etc/sudoers`, and `/etc/sudoers.d/` for unauthorized modifications that may have been made post-escalation to establish persistence.

Containment

  1. Immediately disable or remove the vulnerable LiteSpeed cPanel Plugin: in WHM navigate to LiteSpeed Web Server > Uninstall Plugin, or run `/usr/local/cpanel/whostmgr/docroot/cgi/litespeed/install.sh uninstall` as root, then apply the vendor patch from https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/.
  2. Revoke and rotate all cPanel and WHM credentials for accounts present on the affected host, and reset root password. If SSH keys were added to `/root/.ssh/authorized_keys` post-exploitation, remove unauthorized entries immediately.

Evidence Collection

  1. Collect LiteSpeed error and access logs (`/usr/local/lsws/logs/`), cPanel audit log (`/usr/local/cpanel/logs/`), and Linux auth log (`/var/log/secure` or `/var/log/auth.log`) covering the 24-hour window surrounding the alert.
  2. Capture a memory image and running process list (`ps auxf`, `pstree -p`) from the affected host before any remediation to preserve forensic evidence of injected or spawned processes.

Escalation Criteria

  • !Escalate immediately if post-escalation activity includes creation of new system users, modification of `/etc/sudoers`, installation of SSH keys under `/root/.ssh/`, or deployment of web shells under the cPanel document root.
  • !Escalate if lateral movement indicators are observed: unexpected outbound SSH connections, cron job additions under `/var/spool/cron/root`, or network connections to known threat-actor infrastructure from the affected host.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >LiteSpeed error log: `/usr/local/lsws/logs/error.log` — look for plugin API errors or unexpected root-context operations
  • >cPanel audit log: `/usr/local/cpanel/logs/` — records WHM and plugin API invocations with timestamps and source IPs
  • >Linux audit log: `/var/log/audit/audit.log` — SYSCALL records showing execve, setuid, setgid calls from lshttpd/lsphp PIDs
  • >Modified system files: `/etc/passwd`, `/etc/shadow`, `/etc/sudoers`, `/root/.ssh/authorized_keys` — check mtime against alert timestamp

Tuning Guidance

Reduce false positives by building an allowlist of authorized maintenance windows and admin account names (e.g., the hosting provider's automation user) and excluding those from the detection. If the environment does not run cPanel or LiteSpeed, disable the rule entirely. Increase confidence threshold to 'high' only after validating that routine LiteSpeed plugin update jobs are excluded via schedule-based suppression.

Hunting Queries

Hunt for LiteSpeed processes performing setuid/execve syscalls to elevate to UID 0 over the past 7 days — broader scope than the alert rule to surface earlier-stage or lower-confidence exploitation attempts.

Hunting — KQL
kql 
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ('lshttpd', 'lsphp', 'lsws_cpanel', 'litespeed')
| where SyslogMessage matches regex @"uid=0|euid=0|SUID|setuid|setgid|execve.*root"
| summarize Count=count(), Hosts=make_set(Computer), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ProcessName, SeverityLevel
| order by Count desc
Hunting — SPL
spl 
index=linux_audit sourcetype=linux_audit type=SYSCALL
  (exe="/usr/local/lsws/bin/lshttpd" OR exe="/usr/bin/lsphp" OR exe LIKE "%litespeed%")
  (syscall=59 OR syscall=105 OR syscall=106)
| stats count by host, exe, syscall, uid, euid, auid
| where euid=0 AND uid!=0

Atomic Red Team Tests

Test 1 Simulate LiteSpeed Plugin Privilege Escalation via SUID Binary Invocation
linux

Mimics the exploitation pattern of CVE-2026-48172 by spawning a shell from a process named after lsphp and invoking a SUID-capable binary to transition to UID 0.

Command

bash 
cp /bin/bash /tmp/lsphp && chmod u+s /tmp/lsphp && /tmp/lsphp -p -c 'id; whoami; echo CVE-2026-48172 test'

Cleanup

bash 
rm -f /tmp/lsphp

Expected Telemetry

Process creation event for /tmp/lsphp with SUID bit set; child process reporting uid=0 or euid=0 in execve audit record.

Expected Detection

Alert fires on lsphp-named process with euid=0 transition matching the KQL/SPL/EQL detection rules.

Test 2 LiteSpeed Parent Process Spawning usermod Command
linux

Simulates post-exploitation persistence: a process with a LiteSpeed-like name spawns usermod to add a backdoor user, as an attacker would do after gaining root via CVE-2026-48172.

Command

bash 
sudo bash -c 'useradd -o -u 0 -g 0 -d /root -s /bin/bash litespeed_test 2>/dev/null; echo test_complete'

Cleanup

bash 
sudo userdel -r litespeed_test 2>/dev/null; true

Expected Telemetry

SecurityEvent/audit log showing useradd/usermod syscall with uid=0, parent process traceable to a litespeed-named process or shell.

Expected Detection

Detection rule correlates privileged user-creation command with LiteSpeed process ancestry within the 5-minute sequence window.

Test 3 Unauthorized sudoers Entry via LiteSpeed Process Context
linux

Simulates an attacker who escalated via CVE-2026-48172 adding a sudoers rule to maintain root access, then cleaning up to avoid detection of the LiteSpeed vector.

Command

bash 
echo 'ALL ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/litespeed_test > /dev/null && sudo cat /etc/sudoers.d/litespeed_test

Cleanup

bash 
sudo rm -f /etc/sudoers.d/litespeed_test

Expected Telemetry

File write to /etc/sudoers.d/ captured in Linux audit log (auditd WRITE syscall on path /etc/sudoers.d/litespeed_test) with triggering process running as UID 0.

Expected Detection

Hunting query surfaces sudoers modification; escalation criteria met due to persistence mechanism installation.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1068Exploitation for Privilege EscalationT1548Abuse Elevation Control MechanismT1505.003Web Shell

Same Tactic: Privilege Escalation

Popular Detections