Perimeter + Web-Host Triple: WSO2 API Manager (CVSS 9.8) + Acronis cPanel + LiteSpeed Shared-Host Root

Between September 13 and September 16, 2026, three separate pieces of internet-facing infrastructure each picked up a critical flaw that hands an attacker control of the machine underneath. WSO2 API Manager (CVE-2026-5430, CVSS 9.8) can be tricked into accepting a forged administrator token. Acronis' backup plugin for cPanel and WHM (CVE-2026-87886, CVSS 7.8) lets a local account escalate to root. And LiteSpeed Web Server Enterprise, in versions before 6.3.7, carries an unnumbered flaw that turns one hosting account into root on a shared server. Two of the three are already being exploited.

The common thread is the boundary each product is supposed to hold. An API gateway sits in front of internal services and vouches for who is allowed to reach them. A hosting control panel and its plugins keep hundreds of tenants apart on one kernel. When that boundary fails, the blast radius is not one app or one site, it is everything behind the gateway or everyone on the box. This piece pulls the three disclosures into one patch-and-verify checklist for the defenders who run those planes, and flags exactly which claims are confirmed and which are not.

Our assessment: the two flaws with observed exploitation, WSO2 and Acronis, are the ones to move on first, and "patched" is not the same as "clean" for either. The LiteSpeed bug has no public exploitation report yet, but it bypasses tenant isolation on shared hosting, which is the exact scenario that made the earlier LiteSpeed plugin flaws so damaging.

The WSO2 API Manager JWT Bypass (CVE-2026-5430)

WSO2 disclosed the flaw in advisory WSO2-2026-5328 in May 2026, crediting the Hacktron Team with the discovery. It became an active-exploitation story this week: watchTowr reported that its honeypot network captured forged JSON Web Tokens (JWTs) carrying baked-in administrator privileges arriving on September 13, 2026, and The Hacker News wrote it up on September 16.

The root cause is an improper verification of a cryptographic signature, which WSO2 rates CVSS 9.8 and describes as leading to account takeover. Per the WSO2 advisory, "JWT authentication can be bypassed when a token is signed using an unsupported algorithm." The consequence is that the gateway can be made to trust a token it should reject, including one minted with administrator rights.

Why that matters for defenders: because the gateway brokers requests to internal systems, an administrator-level bypass exposes the backends behind it, along with the consumer keys and secrets of registered applications. The affected products are WSO2 API Manager 4.1.0 through 4.6.0, plus API Control Plane, Traffic Manager, and Universal Gateway at 4.5.0 and 4.6.0.

The reason to treat this as more than a single-app problem is the gateway position in the network. watchTowr Yordan Ganchev, the firm principal threat intelligence specialist, told The Hacker News that a forged token is suspected of being usable to reach every API backend endpoint the gateway fronts, along with the consumer keys and secrets of every registered application, and that the product is by design placed to intercept API requests on their way to internal systems. For a defender, that is the definition of a pivot point: compromise the component that vouches for callers, and you inherit its visibility into traffic and its reach into everything downstream. An administrator-level bypass here is a worst-case starting position, which is why the 9.8 rating understates the operational stakes rather than overstating them.

Patch and verify. Fixes are available for community users in the carbon-apimgt and product-apim pull requests (numbers 13752 and 14167), and for Support Subscription holders through per-version update levels listed in the advisory. Confirm the running update level against WSO2's published list rather than assuming the latest installer covers it. Then treat any administrator token that could have been forged as burned: rotate admin credentials, consumer keys, and application secrets reachable through the gateway, and review gateway logs for unexpected administrative API calls dating back to at least September 13, the date watchTowr first observed forged tokens in the wild. If your deployment predates the fixed update levels and was internet-reachable, assume the credentials behind it are exposed until proven otherwise.

The Acronis Backup Plugin for cPanel and WHM (CVE-2026-87886)

Acronis published advisory SEC-10986 and pushed fixes last week; Help Net Security and The Hacker News reported it on September 16. The flaw affects Acronis' backup extensions for cPanel, WHM, and Plesk on Linux, the add-ons that hosting providers and managed service providers use to offer backup and recovery to their own customers.

CVE-2026-87886 stems from insecure file permissions and carries a CVSS score of 7.8. It lets an authenticated local user escalate to root with no user interaction and in a low-complexity attack, meaning the conditions to trigger it are within an attacker's control. Acronis says exploitation has been detected in limited, targeted attacks against its cPanel and WHM plugin deployments; it reports no signs of exploitation on Plesk.

The reason a mid-severity local flaw earns a spot in a critical roundup is where it sits. Acronis is widely used by web hosting providers and managed service providers, who resell its backup and recovery under their own branding, and the plugin bridges the cPanel, WHM, and Plesk control panels to the Acronis cloud. A privilege-escalation bug in that bridge is not confined to one server: it is present anywhere a provider deployed the extension to offer backup to downstream customers, which is what turns a 7.8 into a multi-tenant exposure. The limited, targeted nature of the attacks reported so far is the one piece of good news, but targeted today does not mean rare tomorrow once a patch reveals the fix.

Patch and verify. Install the fixed builds Acronis names: the Acronis Backup plugin for cPanel and WHM version 1.9.3 HF3, and the Acronis Backup extension for Plesk version 1.8.11. Because the cPanel and WHM path is already being exploited and Acronis has not disclosed what attackers do after they escalate, patching alone does not settle it. On any multi-tenant host that ran an unpatched plugin, hunt for signs of post-exploitation and unexplained root activity rather than assuming the update closed the incident.

The LiteSpeed Enterprise Shared-Hosting Root (No CVE Yet)

cPanel warned in an advisory published on September 14 that a critical flaw in LiteSpeed Web Server Enterprise, in versions before 6.3.7, could let a low-privilege website user gain root on a shared-hosting server. LiteSpeed shipped the fixed 6.3.7 build on September 11. The advisory carries no CVE identifier and no severity score, and does not state whether the flaw has been exploited.

The defensive detail that matters is what the flaw defeats. According to cPanel, it can bypass the controls that keep hosting accounts apart, including CageFS, the CloudLinux tool that gives each account a restricted view of the file system so it cannot see other tenants or the server's configuration. On a shared box where many customers' sites run on one machine, that means one account can reach the others and the server itself.

Patch and verify. Update to 6.3.7 now. Both cPanel and LiteSpeed give the same manual command, which matters because LiteSpeed warned the release may lag before it reaches auto-update, and as of September 15 the vendor's download page still listed 6.3.6 as the stable release:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7

Forcing a version pins the server off its stable update tier; administrators can resume automatic stable updates afterward by running touch /usr/local/lsws/autoupdate/follow_stable. The advisory names only the Enterprise edition and does not address OpenLiteSpeed, for which no matching update had shipped as of September 15. It is the third time since May that a LiteSpeed flaw on cPanel servers has been reported to grant a hosting account root, but the first in the web server itself rather than the plugin. The two earlier ones, CVE-2026-48172 and CVE-2026-54420, were both actively exploited and both landed in CISA's Known Exploited Vulnerabilities catalog. See our earlier coverage of the LiteSpeed cPanel plugin root-code-execution flaw (CVE-2026-48172) for how that pattern played out.

Two gaps are worth planning around. Neither the cPanel advisory nor the LiteSpeed release notes offer a workaround for servers that cannot update immediately, or indicators for checking whether a server has already been hit, so there is no detection content to lean on yet. And the picture around adjacent builds is unsettled: as of September 15 the download page still listed 6.3.6 as stable alongside a July pre-release of 6.4.0 (RC1) whose changelog does not list the three security changes, and the cPanel advisory does not say whether the 6.4.0 release candidates are affected. If you run a release candidate or OpenLiteSpeed, do not assume you are covered, and track the vendors for follow-up.

What Hosting Providers and API-Gateway Admins Should Verify

Work the exploited flaws first, then close the isolation gap on shared hosting.

• WSO2 API Manager: patch to the fixed update level or the community PR build, then rotate any admin JWTs, consumer keys, and application secrets that a forged token could have reached. Review administrative API activity since September 13.
• Acronis backup plugin: install version 1.9.3 HF3 on cPanel and WHM and 1.8.11 on Plesk. Because the cPanel and WHM path is under active, targeted exploitation, treat an unpatched multi-tenant host as potentially compromised and hunt for post-exploitation activity.
• LiteSpeed Enterprise: run the manual lsup.sh command to 6.3.7 rather than waiting for auto-update, confirm the running version, and verify that CageFS and other per-account isolation still hold. Watch for a matching OpenLiteSpeed fix if you run it.
• Across all three: audit the privilege boundaries on shared and multi-tenant servers, and fold these into a risk-based vulnerability management program so the exploited items are prioritized ahead of the merely critical ones. For context on how fast hosting-plane flaws get weaponized, see our coverage of the cPanel and WHM authentication-bypass zero-day (CVE-2026-41940) and the follow-up cPanel Technical Security Release (CVE-2026-29201 through 29203).

Open Questions

Three things are reported but not confirmed, and each changes how you should scope your response.

• How many WSO2 instances have actually been compromised. watchTowr's honeypots show exploitation attempts and captured forged admin tokens, not a confirmed count of breached deployments.
• Which organizations Acronis victims are, and what the attackers did after escalating. Acronis confirms limited, targeted exploitation but has not disclosed victims or post-exploitation behavior.
• The LiteSpeed flaw's CVE identifier. A check of published CVE records on September 15 found none assigned, and neither cPanel nor LiteSpeed has said which changelog entry fixes it.

Updated September 15, 2026: we will revise this if a LiteSpeed CVE is assigned or if WSO2, Acronis, or CISA publish exploitation figures or indicators of compromise.

Primary Documents

• WSO2 security advisory WSO2-2026-5328 (CVE-2026-5430)
• The Hacker News: active exploitation of the WSO2 API Manager JWT bypass
• Acronis security advisory SEC-10986 (CVE-2026-87886)
• Help Net Security: Acronis backup plugin flaw exploited in targeted attacks
• cPanel LiteSpeed Enterprise security advisory, September 14, 2026
• The Hacker News: LiteSpeed Enterprise flaw could let one hosting account gain root