PT-2026-25612 · Litespeed Technologies · Lsws Enterprise+1

Daisuke Nakayama · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-31386

X.com · The Yellow Fall

CVSS v3.1

7.2

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An 8.6 CVSS flaw (CVE-2026-31386) in LiteSpeed Web Server editions allows OS command injection and system compromise. Restrict WebAdmin access immediately. #LiteSpeed #CVE #ServerSecurity #CyberSecurity #InfoSec #CommandInjection #WebHosting #OpenLiteSpeed https://t.co/sKxucJP2Yf https://t.co/92Ga1u2QgT

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-31386

Affected Products

Lsws Enterprise

Openlitespeed

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-31386 · Security Note
• https://litespeedtech.com/products/litespeed-web-server · Note
• https://twitter.com/the_yellow_fall/status/2033536259684274329 · Twitter Post
• https://twitter.com/CVEnew/status/2033583708482244683 · Twitter Post
• https://twitter.com/infoflowcloud/status/2033585796201000988 · Twitter Post
• https://jvn.jp/en/jp/JVN22152812 · Note
• https://openlitespeed.org · Note