CVE-2026-93903
CVE-2026-93903 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-174.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.4)
- EPSS exploit prediction: 0% (16th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-174
- Published:
- Last modified:
Description
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
Frequently asked questions
- What is CVE-2026-93903?
- LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
- How severe is CVE-2026-93903?
- CVE-2026-93903 has a CVSS 4.0 base score of 9.4, rated critical severity.
- Is CVE-2026-93903 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-93903?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-93903 published?
- CVE-2026-93903 was published on 2026-09-30.
References
- https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1
- https://www.litespeedtech.com/products/litespeed-web-server/release-log
Other CWE-174 vulnerabilities
- CVE-2026-75899 — High (CVSS 7.5): fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the…
- CVE-2026-92839 — Medium (CVSS 4.3): Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the…