CVE-2026-93903: Litespeedtech LiteSpeed Web Server

Critical severity, CVSS 9.4. EPSS: 0.3% chance of exploitation in the next 30 days.

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

Affected products

• Litespeedtech LiteSpeed Web Server: before 6.3.7 build 1 (fixed in 6.3.7 build 1)

Published 2026-09-30. Last modified 2026-09-30.