ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

ConfigServer Security & Firewall

3 mentions in 7 days · 3 in 30 days · 3 total · first seen · last

Search everything

Timeline

cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands

CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.

CVE-2026-65638 affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29 and allows unauthenticated remote attackers to execute arbitrary commands through the MESSENGER service, running under the unprivileged CSF service account rather than root. Exploitation requires the non-default MESSENGER service to be enabled and a reCAPTCHA secret configured, reducing exposure for standard deployments. CSF 16.30 and later fix the flaw; administrators who cannot update immediately can set MESSENGER = 0 in /etc/csf/csf.conf as a temporary mitigation.

Cyber Security News · 4d agoVulnerability 6 sourcesCVE-2026-65638

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.

GBHackers · 4d agoVulnerability 6 sourcesCVE-2026-65638

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.

Canadian Centre for Cyber Securityupdated · 4d agofirst · 5d agoAdvisory 6 sourcesCVE-2026-65638CVE-2026-65639CVE-2026-67401

Related CVEs

  • CVE-2026-656389.2—
    Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
    CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.
    · ConfigServer Security & Firewall (CSF) · WebPros ConfigServer Security & Firewall (WebPros-maintained fork) Versions containing the vulnerable code; fixed in version 16.30mass
  • CVE-2026-674019.9<1%
    Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
    CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely.
    · cPanel (WebPros) cPanel PoC ×3mass
  • CVE-2026-656399.5—
    OS Command Injection in ConfigServer Security & Firewall (CSF) Allows Root RCE
    CVE-2026-65639 is an OS command injection flaw (CWE-78, CVSS 4.0 score 9.5, critical) in the advanced-rule parser of ConfigServer Security & Firewall (CSF), a widely used Linux firewall suite. It is triggered when the parser processes rule data supplied by a configured allow/deny feed: because feed-supplied rule content is not sufficiently validated, an attacker who can control the contents of such a feed (for example by controlling or tampering with the feed source) can inject and execute arbitrary shell commands. Injected commands run as root, so successful exploitation yields full takeover of the host, with high impact to confidentiality, integrity, and availability (the CVSS AT:P metric reflects the precondition that a feed must be configured and attacker-influenced). Affected deployments include versions originally distributed by ConfigServer and versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed the issue in version 16.30, while other independently maintained forks may also be affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and there is no confirmed exploitation in the wild at this time.
    · ConfigServer Security & Firewall (CSF) - original distribution · WebPros ConfigServer Security & Firewall (CSF) - WebPros-maintained fork versions containing the vulnerable code prior to the fix; WebPros addressed the vulnerability in version 16.30mass

Appears with

vendor cPanel 3product WHM 2product cPanel 2organization cPanel 2vendor WebPros 1product cPanel & WHM 1vendor ConfigServer Security & Firewall 1organization Canadian Centre for Cyber Security 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.