Vulnerability · Published Mar 16, 2026 · Assigned by jpcert
CVE-2026-31386
High 7.2
In plain English
A high-severity OS command injection in LSWS Enterprise from LiteSpeed Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)1.5%top 26.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LiteSpeed Technologies | OpenLiteSpeed | all versions |
| LiteSpeed Technologies | LSWS Enterprise | all versions |
Weakness: CWE-78 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H