The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive mandating affected agencies to remediate a critical LiteSpeed cPanel User-End Plugin vulnerability that is actively being exploited in the wild and has now been added to the agency’s Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-48172, carries a maximum CVSS score of 10/10, affecting LiteSpeed cPanel plugin versions prior to 2.4.5, and stems from improper handling of Redis enable/disable functionality within the lsws.redisAble function. The vulnerability allows any cPanel user, including compromised or low-privileged accounts, to execute arbitrary scripts with root privileges, creating a severe privilege escalation and remote code execution risk on internet-facing servers. In response, LiteSpeed released emergency patches and urged administrators to immediately upgrade to at least version 2.4.7, while also reviewing cPanel logs for suspicious redisAble API activity using a provided grep command to identify potentially malicious IP addresses and signs of compromise. Under Binding Operational Directive 22-01, all Federal Civilian Executive Branch (FCEB) agencies have until May 29, 2026 to secure affected systems, though CISA strongly encouraged private-sector organizations to prioritize patching and mitigation as well, warning that vulnerabilities enabling root-level access on exposed infrastructure remain one of the most common and dangerous attack vectors leveraged by cyber threat actors. CTIX analysts strongly urge administrators to follow the CISA guidance immediately to identify if there are signs of exploitation and prevent future exploitation.