VulnerabilityAnalyzed
CVE-2026-31386
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability.
HIGH 8.6EPSS 1.51%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.51% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- litespeedtech/litespeed web server · litespeedtech/openlitespeed
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/jp/JVN22152812/Third Party Advisory
- https://openlitespeed.org/Product
- https://www.litespeedtech.com/products/litespeed-web-serverProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.