PT-2026-25612 · Litespeed Technologies+1 · Lsws Enterprise+2

Daisuke Nakayama · Publicado 2026-03-16 · Atualizado 2026-06-08 · CVE-2026-31386

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed and LSWS Enterprise versions (affected versions not specified)

Description OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection issue. An attacker with administrative privileges can execute arbitrary OS commands. The issue allows for potential system compromise. The severity is reported as 8.6.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-31386

Produtos afetados

Lsws Enterprise

Openlitespeed

Litespeed Web Server

Referências · 10

• https://twitter.com/infoflowcloud/status/2033585796201000988 · Publicação no Twitter
• https://t.me/CVEtracker/47506 · Publicação no Telegram
• https://openlitespeed.org · Nota
• https://twitter.com/CVEnew/status/2033583708482244683 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31386 · Nota de Segurança
• https://litespeedtech.com/products/litespeed-web-server · Nota
• https://twitter.com/the_yellow_fall/status/2033536259684274329 · Publicação no Twitter
• https://t.me/cveNotify/166477 · Publicação no Telegram
• https://jvn.jp/en/jp/JVN22152812 · Nota
• https://twitter.com/dailycve/status/2063998277297537025 · Publicação no Twitter