LiteSpeed Enterprise Privilege Escalation: Update to 6.3.7 or Later
cPanel has disclosed a critical privilege-escalation vulnerability affecting LiteSpeed Web Server Enterprise versions before 6.3.7. On shared-hosting systems, cPanel says a malicious low-privilege website user could escape expected account-isolation controls, including CageFS, and potentially gain root-level access to the server.
The remediation floor is LiteSpeed Web Server Enterprise 6.3.7 or later. cPanel published the advisory on September 14, 2026 and recommends upgrading every affected installation. LiteSpeed's current changelog lists 6.3.7 Build 0, released on September 11.
The disclosure is particularly consequential for multi-tenant hosting because root access can expose or alter other hosted websites as well as the underlying server. The public cPanel advisory currently identifies the affected product and fixed version without assigning a CVE identifier or CVSS score.
Affected and fixed versions
| LiteSpeed Web Server Enterprise | Status |
|---|---|
| Earlier than 6.3.7 | Affected according to cPanel |
| 6.3.7 or later | Recommended remediation floor |
cPanel provides this command to install version 6.3.7:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
Administrators should verify the installed server version across every relevant host rather than relying on the version of a control-panel plugin. LiteSpeed's documentation also provides a build check using the installation's BUILD file.
What LiteSpeed changed in 6.3.7
LiteSpeed's official changelog records three security changes in 6.3.7 Build 0:
- enhanced
lscgidrequest authentication and validation; - stronger validation of internal redirect URLs;
- blocking important internal-use environment variables from being set through
.htaccess.
The changelog does not map the cPanel privilege-escalation disclosure to one specific bullet. Operators therefore have a clear remediation boundary—6.3.7 or later—without needing to infer an unpublished root cause from the individual release-note entries.
Why shared-hosting operators should prioritize the update
Shared-hosting security depends on keeping one tenant's account and processes separated from other customers and from privileged server resources. cPanel says this vulnerability can bypass expected account-isolation controls, explicitly naming CageFS, and allow a malicious website user to escape the restricted environment and potentially reach root.
A successful escalation could give the attacker access to other hosted sites and the server itself. That makes the update relevant to hosting providers and administrators running multi-tenant LiteSpeed Enterprise systems even when the individual hosted websites are otherwise isolated by account controls.
This is separate from the 2026 LiteSpeed cPanel plugin vulnerabilities
The September disclosure concerns LiteSpeed Web Server Enterprise and its 6.3.7 remediation floor. Earlier 2026 security issues involving LiteSpeed's cPanel plugin are separate component-level vulnerabilities and should not be used as identifiers for this server flaw.
That distinction matters during inventory checks: the web-server version determines exposure to the September Enterprise advisory. Updating a plugin alone does not establish that the LiteSpeed Web Server Enterprise binary has reached the 6.3.7 remediation floor.
Remediation checklist
- Inventory LiteSpeed Web Server Enterprise versions on shared-hosting servers.
- Upgrade installations earlier than 6.3.7 to 6.3.7 or later using the supported update path; cPanel publishes the
lsup.shcommand above for an immediate 6.3.7 update. - Confirm the running server version/build after the update and verify that LiteSpeed restarted normally.
- Prioritize multi-tenant systems where untrusted or customer-controlled website accounts can execute server-side workloads.
- Continue monitoring the cPanel and LiteSpeed advisories for any later CVE assignment, exploitation information or additional remediation guidance.
Bottom line
The current first-party guidance is direct: LiteSpeed Web Server Enterprise releases before 6.3.7 are affected, and administrators should upgrade to 6.3.7 or later. The impact described by cPanel reaches the core isolation boundary of shared hosting, where a low-privilege website user could potentially obtain root access and affect other tenants.
The public evidence supports immediate version-based remediation. Technical exploit details, a CVE identifier and an in-the-wild exploitation statement have not been published in the primary advisory, so operational decisions should center on the confirmed affected-version boundary and the official update guidance.