LiteSpeed Enterprise Privilege Escalation: Update to 6.3.7 or Later


cPanel has disclosed a critical privilege-escalation vulnerability affecting LiteSpeed Web Server Enterprise versions before 6.3.7. On shared-hosting systems, cPanel says a malicious low-privilege website user could escape expected account-isolation controls, including CageFS, and potentially gain root-level access to the server.

The remediation floor is LiteSpeed Web Server Enterprise 6.3.7 or later. cPanel published the advisory on September 14, 2026 and recommends upgrading every affected installation. LiteSpeed's current changelog lists 6.3.7 Build 0, released on September 11.

The disclosure is particularly consequential for multi-tenant hosting because root access can expose or alter other hosted websites as well as the underlying server. The public cPanel advisory currently identifies the affected product and fixed version without assigning a CVE identifier or CVSS score.

Affected and fixed versions

LiteSpeed Web Server Enterprise Status
Earlier than 6.3.7 Affected according to cPanel
6.3.7 or later Recommended remediation floor

cPanel provides this command to install version 6.3.7:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7

Administrators should verify the installed server version across every relevant host rather than relying on the version of a control-panel plugin. LiteSpeed's documentation also provides a build check using the installation's BUILD file.

What LiteSpeed changed in 6.3.7

LiteSpeed's official changelog records three security changes in 6.3.7 Build 0:

  • enhanced lscgid request authentication and validation;
  • stronger validation of internal redirect URLs;
  • blocking important internal-use environment variables from being set through .htaccess.

The changelog does not map the cPanel privilege-escalation disclosure to one specific bullet. Operators therefore have a clear remediation boundary—6.3.7 or later—without needing to infer an unpublished root cause from the individual release-note entries.

Why shared-hosting operators should prioritize the update

Shared-hosting security depends on keeping one tenant's account and processes separated from other customers and from privileged server resources. cPanel says this vulnerability can bypass expected account-isolation controls, explicitly naming CageFS, and allow a malicious website user to escape the restricted environment and potentially reach root.

A successful escalation could give the attacker access to other hosted sites and the server itself. That makes the update relevant to hosting providers and administrators running multi-tenant LiteSpeed Enterprise systems even when the individual hosted websites are otherwise isolated by account controls.

This is separate from the 2026 LiteSpeed cPanel plugin vulnerabilities

The September disclosure concerns LiteSpeed Web Server Enterprise and its 6.3.7 remediation floor. Earlier 2026 security issues involving LiteSpeed's cPanel plugin are separate component-level vulnerabilities and should not be used as identifiers for this server flaw.

That distinction matters during inventory checks: the web-server version determines exposure to the September Enterprise advisory. Updating a plugin alone does not establish that the LiteSpeed Web Server Enterprise binary has reached the 6.3.7 remediation floor.

Remediation checklist

  1. Inventory LiteSpeed Web Server Enterprise versions on shared-hosting servers.
  2. Upgrade installations earlier than 6.3.7 to 6.3.7 or later using the supported update path; cPanel publishes the lsup.sh command above for an immediate 6.3.7 update.
  3. Confirm the running server version/build after the update and verify that LiteSpeed restarted normally.
  4. Prioritize multi-tenant systems where untrusted or customer-controlled website accounts can execute server-side workloads.
  5. Continue monitoring the cPanel and LiteSpeed advisories for any later CVE assignment, exploitation information or additional remediation guidance.

Bottom line

The current first-party guidance is direct: LiteSpeed Web Server Enterprise releases before 6.3.7 are affected, and administrators should upgrade to 6.3.7 or later. The impact described by cPanel reaches the core isolation boundary of shared hosting, where a low-privilege website user could potentially obtain root access and affect other tenants.

The public evidence supports immediate version-based remediation. Technical exploit details, a CVE identifier and an in-the-wild exploitation statement have not been published in the primary advisory, so operational decisions should center on the confirmed affected-version boundary and the official update guidance.

Sources