EUVD-2026-12333Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection vulnerability. An arbitrary OS command may be executed by an attacker with the administrative privilege.
AnalysisAI
OS command injection in OpenLiteSpeed and LSWS Enterprise web servers from LiteSpeed Technologies allows administrative users to execute arbitrary operating system commands on the host. The flaw affects all versions of both products per ENISA EUVD and was reported by JPCERT/CC via JVN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already hold administrative (WebAdmin) privileges on the OpenLiteSpeed or LSWS Enterprise instance (CVSS PR:H), and the WebAdmin interface must be reachable over the network from the attacker's position (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack that requires high privileges (administrator) and no user interaction, yielding high impact on confidentiality, integrity, and availability of the vulnerable system but no scope change to other components. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WebAdmin credentials - through credential reuse, phishing, a leaked backup, or an over-privileged delegated hosting account - authenticates to the OpenLiteSpeed or LSWS Enterprise administrative interface over the network. They submit a crafted configuration value containing shell metacharacters into a field that is later interpolated into an OS command by the server, causing arbitrary commands to execute as the server account. … |
| Remediation | No vendor-released patch identified at time of analysis in the provided data; consult the JVN advisory at https://jvn.jp/en/jp/JVN22152812/ and the LiteSpeed Technologies product pages (https://openlitespeed.org/ and https://www.litespeedtech.com/products/litespeed-web-server) for the fixed release and upgrade to it as soon as available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all OpenLiteSpeed and LSWS Enterprise deployments; enforce multi-factor authentication on all administrative accounts; audit and revoke unnecessary administrative privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today