Which versions of OpenLiteSpeed are affected by CVE-2026-31386?

OpenLiteSpeed and LSWS Enterprise web servers contain a critical OS command injection vulnerability (CVE-2026-31386) affecting all versions, allowing administrative users to gain complete control of…

How to fix or mitigate CVE-2026-31386?

Within 24 hours: Inventory all OpenLiteSpeed and LSWS Enterprise deployments; enforce multi-factor authentication on all administrative accounts; audit and revoke unnecessary administrative privileges. Within 7 days: Implement IP-based network controls to restrict administrative interface access; enable comprehensive audit logging for all administrative activities and command execution; conduct formal review to identify and eliminate unused admin accounts. Within 30 days: Subscribe to LiteSpeed Technologies security notifications; evaluate alternative web server solutions or request vendor patch timeline; implement enhanced alerting on suspicious administrative activities.

OpenLiteSpeed CVE-2026-31386

Q: What is the CVSS score of CVE-2026-31386?

CVE-2026-31386 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-12333 HIGH

OS Command Injection (CWE-78)

2026-03-16 jpcert

Command Injection Lsws Enterprise Openlitespeed Litespeed Technologies

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 08, 2026 - 13:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 08, 2026 - 13:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 08, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 13:22 NVD

7.2 (HIGH) 8.6 (HIGH)

EUVD ID Assigned

Mar 16, 2026 - 06:00 euvd

EUVD-2026-12333

Analysis Generated

Mar 16, 2026 - 06:00 vuln.today

CVE Published

Mar 16, 2026 - 05:21 nvd

HIGH 7.2

DescriptionCVE.org

OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.

AnalysisAI

OS command injection in OpenLiteSpeed and LSWS Enterprise web servers from LiteSpeed Technologies allows administrative users to execute arbitrary operating system commands on the host. The flaw affects all versions of both products per ENISA EUVD and was reported by JPCERT/CC via JVN. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 37th percentile), but the high CVSS 4.0 score (8.6) reflects full confidentiality, integrity, and availability impact on the underlying host.

Technical ContextAI

OpenLiteSpeed is the open-source edition of LiteSpeed Web Server (LSWS), while LSWS Enterprise is the commercial high-performance HTTP server widely deployed for shared hosting and WordPress workloads. Both products expose a web-based administrative console (WebAdmin) for configuration of virtual hosts, listeners, scripts, and server processes. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controllable input reachable from the administrative interface is concatenated into a shell command without proper sanitization or argument separation, allowing shell metacharacters to break out of the intended command context. CPEs cpe:2.3:a:litespeed_technologies:openlitespeed:*:* and cpe:2.3:a:litespeed_technologies:lsws_enterprise:*:* indicate version-agnostic applicability.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; consult the JVN advisory at https://jvn.jp/en/jp/JVN22152812/ and the LiteSpeed Technologies product pages (https://openlitespeed.org/ and https://www.litespeedtech.com/products/litespeed-web-server) for the fixed release and upgrade to it as soon as available. Until a patched build is installed, restrict network reachability of the WebAdmin console (default TCP 7080) to a management VLAN, VPN, or specific bastion IPs via firewall rules so it is never exposed to the internet - the side effect is that legitimate administrators must connect through that path. Rotate WebAdmin credentials, enforce strong unique passwords, and audit which accounts hold administrative privilege to minimize the population that can trigger the injection; in multi-tenant hosting, consider delegating only non-administrative roles to customers. Enable and review WebAdmin access logs for unexpected configuration changes or command-execution-related parameters as a detection control.