High-Severity Flaw Exposes LiteSpeed Web Servers to OS Command Injection

A critical OS command injection vulnerability (CVE-2026-31386, CVSSv4 8.6) has been disclosed in the LiteSpeed Web Server WebAdmin console (affecting open-source and enterprise editions). An attacker with administrative privileges may execute arbitrary operating-system commands, risking privilege escalation and lateral movement across hosting environments; vendor guidance recommends restricting WebAdmin network access, IP whitelisting, requiring VPNs for admin access, and monitoring administrative logs.