CVE-2026-67402

ConfigServer Security & Firewall (CSF) ships an insecure Apache configuration that maps the entire /usr/bin directory as CGI programs through the Messenger v3 HTTPS virtual host. A remote, unauthenticated attacker whose IP address is already blocked by CSF can request any mapped executable via that HTTPS vhost, causing Apache to treat it as a CGI script and execute it. Successful exploitation lets the attacker run arbitrary commands on the server with the privileges of the Apache user. Only installations with CSF Messenger v3 and its HTTPS mode enabled are affected; WebPros fixed the flaw in CSF version 16.31. No public proof-of-concept or in-the-wild exploitation is known, and EPSS currently estimates the 30-day exploitation probability at about 0.3%.

What to do: Upgrade CSF to version 16.31 or later. Until patched, disable Messenger v3 HTTPS mode (or the Messenger feature entirely) to remove the exposed virtual host, and confirm whether your configuration actually enables Messenger v3 with HTTPS. Review Apache access logs for requests to executables under /usr/bin arriving via the Messenger vhost as an indicator of probing or compromise.