Detect LiteSpeed cPanel Plugin Privilege Escalation (CVE-2026-48172) in Microsoft Sentinel
Detects exploitation of CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin (CWE-266: Incorrect Privilege Assignment). Attackers with low-privileged cPanel access can leverage the plugin's improper privilege handling to elevate to root or administrative system access. This vulnerability is actively exploited in the wild (CISA KEV).
MITRE ATT&CK
KQL Detection Query
let LiteSpeedPaths = dynamic(['/usr/local/lsws', '/opt/litespeed', '/usr/local/cpanel/whostmgr/docroot/cgi/litespeed']);
let SuspiciousCommands = dynamic(['chmod', 'chown', 'sudo', 'su', 'usermod', 'passwd', 'visudo', 'crontab']);
union isfuzzy=true
(
Syslog
| where ProcessName in~ ('lsphp', 'lshttpd', 'litespeed', 'lsws_cpanel')
| where SyslogMessage has_any ('privilege', 'escalat', 'root', 'uid=0', 'euid=0', 'suid')
| extend EventType = 'SyslogPrivilegeEscalation'
),
(
SecurityEvent
| where EventID in (4688, 4672, 4728, 4732)
| where NewProcessName has_any (LiteSpeedPaths) or ParentProcessName has_any (LiteSpeedPaths)
| extend EventType = 'WindowsProcessPrivilege'
),
(
AuditLogs
| where OperationName has_any ('litespeed', 'cpanel')
| where ResultDescription has_any ('privilege', 'escalation', 'root access')
| extend EventType = 'AuditPrivilegeChange'
)
| project TimeGenerated, EventType, Computer, AccountName = coalesce(AccountName, tostring(TargetAccount)), ProcessName = coalesce(ProcessName, NewProcessName), CommandLine = coalesce(SyslogMessage, CommandLine), _ResourceId
| extend RiskScore = case(
CommandLine has 'uid=0', 90,
CommandLine has 'euid=0', 90,
CommandLine has_any ('visudo', 'usermod'), 80,
CommandLine has_any ('chmod +s', 'chown root'), 85,
70
)
| where RiskScore >= 70
| order by TimeGenerated descDetects LiteSpeed cPanel Plugin processes spawning with elevated privileges or executing privilege-escalation commands on Linux/cPanel hosts. Correlates syslog, security events, and audit logs for evidence of CVE-2026-48172 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- LiteSpeed administrative tasks performed by legitimate sysadmins during maintenance windows
- Automated cPanel plugin updates that temporarily run as root
- Hosting provider provisioning scripts that invoke LiteSpeed with elevated context
- Monitoring agents that inspect LiteSpeed process state and trigger audit events
Other platforms for CVE-2026-48172
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate LiteSpeed Plugin Privilege Escalation via SUID Binary Invocation
Expected signal: Process creation event for /tmp/lsphp with SUID bit set; child process reporting uid=0 or euid=0 in execve audit record.
- Test 2LiteSpeed Parent Process Spawning usermod Command
Expected signal: SecurityEvent/audit log showing useradd/usermod syscall with uid=0, parent process traceable to a litespeed-named process or shell.
- Test 3Unauthorized sudoers Entry via LiteSpeed Process Context
Expected signal: File write to /etc/sudoers.d/ captured in Linux audit log (auditd WRITE syscall on path /etc/sudoers.d/litespeed_test) with triggering process running as UID 0.
Response Playbook
Triage
- Identify the affected host(s) by correlating process telemetry for lshttpd, lsphp, or lsws_cpanel with UID-0 transitions. Confirm the LiteSpeed cPanel Plugin version installed via `rpm -qa | grep -i litespeed` or `/usr/local/lsws/bin/lshttpd -v`.
- Check cPanel WHM audit log (`/usr/local/cpanel/logs/`) and LiteSpeed error logs (`/usr/local/lsws/logs/error.log`) for anomalous plugin API calls or unexpected privilege grants around the alert timestamp.
- Determine the user account context at the time of the event: was the triggering user a low-privileged cPanel reseller or end-user? Privilege escalation from such an account is a strong indicator of exploitation.
- Review `/etc/passwd`, `/etc/sudoers`, and `/etc/sudoers.d/` for unauthorized modifications that may have been made post-escalation to establish persistence.
Containment
- Immediately disable or remove the vulnerable LiteSpeed cPanel Plugin: in WHM navigate to LiteSpeed Web Server > Uninstall Plugin, or run `/usr/local/cpanel/whostmgr/docroot/cgi/litespeed/install.sh uninstall` as root, then apply the vendor patch from https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/.
- Revoke and rotate all cPanel and WHM credentials for accounts present on the affected host, and reset root password. If SSH keys were added to `/root/.ssh/authorized_keys` post-exploitation, remove unauthorized entries immediately.
Evidence Collection
- Collect LiteSpeed error and access logs (`/usr/local/lsws/logs/`), cPanel audit log (`/usr/local/cpanel/logs/`), and Linux auth log (`/var/log/secure` or `/var/log/auth.log`) covering the 24-hour window surrounding the alert.
- Capture a memory image and running process list (`ps auxf`, `pstree -p`) from the affected host before any remediation to preserve forensic evidence of injected or spawned processes.
Escalation Criteria
- !Escalate immediately if post-escalation activity includes creation of new system users, modification of `/etc/sudoers`, installation of SSH keys under `/root/.ssh/`, or deployment of web shells under the cPanel document root.
- !Escalate if lateral movement indicators are observed: unexpected outbound SSH connections, cron job additions under `/var/spool/cron/root`, or network connections to known threat-actor infrastructure from the affected host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
LiteSpeed error log: `/usr/local/lsws/logs/error.log` — look for plugin API errors or unexpected root-context operations - >
cPanel audit log: `/usr/local/cpanel/logs/` — records WHM and plugin API invocations with timestamps and source IPs - >
Linux audit log: `/var/log/audit/audit.log` — SYSCALL records showing execve, setuid, setgid calls from lshttpd/lsphp PIDs - >
Modified system files: `/etc/passwd`, `/etc/shadow`, `/etc/sudoers`, `/root/.ssh/authorized_keys` — check mtime against alert timestamp
Tuning Guidance
Reduce false positives by building an allowlist of authorized maintenance windows and admin account names (e.g., the hosting provider's automation user) and excluding those from the detection. If the environment does not run cPanel or LiteSpeed, disable the rule entirely. Increase confidence threshold to 'high' only after validating that routine LiteSpeed plugin update jobs are excluded via schedule-based suppression.
Hunting Queries
Hunt for LiteSpeed processes performing setuid/execve syscalls to elevate to UID 0 over the past 7 days — broader scope than the alert rule to surface earlier-stage or lower-confidence exploitation attempts.
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ('lshttpd', 'lsphp', 'lsws_cpanel', 'litespeed')
| where SyslogMessage matches regex @"uid=0|euid=0|SUID|setuid|setgid|execve.*root"
| summarize Count=count(), Hosts=make_set(Computer), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ProcessName, SeverityLevel
| order by Count descindex=linux_audit sourcetype=linux_audit type=SYSCALL
(exe="/usr/local/lsws/bin/lshttpd" OR exe="/usr/bin/lsphp" OR exe LIKE "%litespeed%")
(syscall=59 OR syscall=105 OR syscall=106)
| stats count by host, exe, syscall, uid, euid, auid
| where euid=0 AND uid!=0Atomic Red Team Tests
Mimics the exploitation pattern of CVE-2026-48172 by spawning a shell from a process named after lsphp and invoking a SUID-capable binary to transition to UID 0.
Command
cp /bin/bash /tmp/lsphp && chmod u+s /tmp/lsphp && /tmp/lsphp -p -c 'id; whoami; echo CVE-2026-48172 test'Cleanup
rm -f /tmp/lsphpExpected Telemetry
Process creation event for /tmp/lsphp with SUID bit set; child process reporting uid=0 or euid=0 in execve audit record.
Expected Detection
Alert fires on lsphp-named process with euid=0 transition matching the KQL/SPL/EQL detection rules.
Simulates post-exploitation persistence: a process with a LiteSpeed-like name spawns usermod to add a backdoor user, as an attacker would do after gaining root via CVE-2026-48172.
Command
sudo bash -c 'useradd -o -u 0 -g 0 -d /root -s /bin/bash litespeed_test 2>/dev/null; echo test_complete'Cleanup
sudo userdel -r litespeed_test 2>/dev/null; trueExpected Telemetry
SecurityEvent/audit log showing useradd/usermod syscall with uid=0, parent process traceable to a litespeed-named process or shell.
Expected Detection
Detection rule correlates privileged user-creation command with LiteSpeed process ancestry within the 5-minute sequence window.
Simulates an attacker who escalated via CVE-2026-48172 adding a sudoers rule to maintain root access, then cleaning up to avoid detection of the LiteSpeed vector.
Command
echo 'ALL ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/litespeed_test > /dev/null && sudo cat /etc/sudoers.d/litespeed_testCleanup
sudo rm -f /etc/sudoers.d/litespeed_testExpected Telemetry
File write to /etc/sudoers.d/ captured in Linux audit log (auditd WRITE syscall on path /etc/sudoers.d/litespeed_test) with triggering process running as UID 0.
Expected Detection
Hunting query surfaces sudoers modification; escalation criteria met due to persistence mechanism installation.