OS Command Injection Vulnerability in LiteSpeed Web Server by LiteSpeed Technologies
CVE-2026-31386

8.6HIGH

Key Information:

Vendor

Litespeed Technologies

Status
Openlitespeed
Lsws Enterprise
Vendor
CVE Published:
16 March 2026

What is CVE-2026-31386?

The LiteSpeed Web Server and OpenLiteSpeed, developed by LiteSpeed Technologies, have a vulnerability that allows an attacker with administrative privileges to execute arbitrary OS commands. This exploitation can lead to unauthorized access and potential system compromise if not addressed promptly. It is crucial for users to ensure they are utilizing the latest security patches to maintain the integrity of their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

LSWS Enterprise all versions

OpenLiteSpeed all versions

References

https://openlitespeed.org/
https://www.litespeedtech.com/products/litespeed-web-server
https://jvn.jp/en/jp/JVN22152812/

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.