A critical vulnerability has been identified in **LiteSpeed Web Server Enterprise**, posing a severe threat to shared-hosting environments. This flaw could enable a low-privilege website user to achieve root access on a server, as detailed in an advisory published by **cPanel** on September 14. ### The Scope of the Vulnerability In shared-hosting setups, multiple customer websites operate on a single machine. Exploiting this vulnerability could grant an attacker, possessing just one hosting account, the ability to access or modify other websites and the server itself. This circumvents crucial security measures designed to isolate hosting accounts. **cPanel** confirmed that the flaw affects **LiteSpeed Web Server Enterprise** versions prior to 6.3.7. Administrators are strongly advised to update to version 6.3.7, which **LiteSpeed Technologies** released on September 11. ### Bypassing Isolation Mechanisms The vulnerability is particularly concerning as it can bypass account separation controls, including **CageFS**. **CageFS**, a tool by **CloudLinux**, is designed to provide each hosting account with a restricted view of the file system, preventing access to other accounts or the server's configuration files. Its circumvention highlights the severity of this new flaw. Neither **cPanel**'s advisory nor **LiteSpeed**'s release notes offer detailed technical specifics on how the flaw operates. **LiteSpeed**'s announcement for version 6.3.7 simply mentioned "Security improvements, bug fixes, and more!" Its changelog lists three security changes, but none specifically identify a privilege-escalation flaw. ### Lack of Public Identifiers and Exploitation Details As of September 15, the advisory does not include a **CVE** identifier or a severity score, and no corresponding **CVE** records have been publicly disclosed. Furthermore, there is no public information indicating whether this flaw has been actively exploited in the wild. ### Immediate Update Recommended Both **cPanel** and **LiteSpeed** recommend the following command for an immediate update to version 6.3.7: `/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7` It is crucial for administrators to perform this manual update, as **LiteSpeed** noted there might be a delay before the release becomes available through auto-update mechanisms. As of September 15, **LiteSpeed**'s download page still listed 6.3.6 as the stable release. Administrators who force a specific version with this command should note that it overrides the server's stable update tier. To resume automatic stable updates afterward, they can run `touch /usr/local/lsws/autoupdate/follow_stable`. No workarounds have been provided for servers that cannot be updated immediately, nor are there indicators for detecting a potential compromise. The advisory specifically names the Enterprise edition, with no mention of **OpenLiteSpeed**, its open-source counterpart, which has not received a corresponding update. ### A Recurring Issue for LiteSpeed on cPanel This marks the third instance since May where a flaw in **LiteSpeed** software on **cPanel** servers could grant root access to a hosting account. However, this is the first time the vulnerability resides within the web server itself. Previously, in May and June, **LiteSpeed** addressed two critical flaws (**CVE-2026-48172** and **CVE-2026-54420**) in its user-end **cPanel** plugin. Both were actively exploited and subsequently added to **CISA**'s Known Exploited Vulnerabilities catalog. The ongoing pattern underscores the importance of diligent patching and monitoring for users of **LiteSpeed** products within **cPanel** environments. **Ghost Protocol** has reached out to **LiteSpeed**, **cPanel**, and **CloudLinux** for further comments regarding this vulnerability.