CVE-2024-28000
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
Early warning: exploitation observed
- Exploitation observed since Aug 21, 2024
- Not yet in the official CISA catalogue
- Attacked 1 day before the vulnerability was made public
- Confirmed by sensors, not only by reports
Source: VulnCheck KEV · Aug 26, 2026 Apr 23, 2026 Sep 25, 2025 Aug 21, 2024
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-266
Vendorslitespeedtech
Affected products
| Vendors | Product | Versions |
|---|---|---|
| litespeedtech | litespeed cache | < 6.4 |
Related articles
Cyberattack on Philippine Nuclear and Navy: ownCloud and WordPress Used as Attack Vector
On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam 31.58.209 . 241 exposing a Python SimpleHTTP directory on port 8000.
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
This product uses the NVD API but is not endorsed or certified by the NVD.