OpenLiteSpeed EUVD-2026-12333

The attacker must already hold administrative (WebAdmin) privileges on the OpenLiteSpeed or LSWS Enterprise instance (CVSS PR:H), and the WebAdmin interface must be reachable over the network from the attacker's position (AV:N). No user interaction by another operator is required (UI:N) and attack complexity is low (AC:L), but exploitation is limited by the high privilege prerequisite: an attacker without valid admin credentials cannot trigger this issue. There is no indication in the available data of a non-default configuration requirement - the vulnerability appears to affect all versions of both products as shipped.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack that requires high privileges (administrator) and no user interaction, yielding high impact on confidentiality, integrity, and availability of the vulnerable system but no scope change to other components. EPSS is low at 0.16% (37th percentile), consistent with the PR:H gating: an attacker must already hold admin credentials to the WebAdmin console, sharply narrowing the realistic exploit population. The CVE is not on CISA KEV and no public POC was identified, so this is a post-authentication privilege-to-OS escalation rather than a pre-auth internet-wide threat. Practical risk is highest in multi-tenant or delegated-admin hosting environments where the WebAdmin role is held by less-trusted users, or where admin credentials may be reused or phished; in single-tenant deployments where admin equals root-equivalent already, the marginal risk is lower. Note that 'all versions' affected (per EUVD) but no fixed version is listed in the provided data - this is a gap that should be verified against the JVN advisory before deployment decisions.

An attacker who has obtained WebAdmin credentials - through credential reuse, phishing, a leaked backup, or an over-privileged delegated hosting account - authenticates to the OpenLiteSpeed or LSWS Enterprise administrative interface over the network. They submit a crafted configuration value containing shell metacharacters into a field that is later interpolated into an OS command by the server, causing arbitrary commands to execute as the server account. No public POC was identified at time of analysis, so the scenario is constructed from the CVSS vector and CWE-78 classification.