ConfigServer Security & Firewall

Mentions · 7d0
Mentions · 30d0
All mentions4
First seenSep 10, 2026
Last mentionedSep 23, 2026

Timeline

4 articles · newest first

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.

Cyber Security NewsSep 23, 15:18 UTC · Sep 23, 2026VulnerabilityCVE-2026-68490 CVE-2026-87899 CVE-2026-87900+33 · 2 reads

cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands

CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.

Cyber Security NewsSep 11, 11:28 UTC · Sep 11, 2026Vulnerability 2 sourcesCVE-2026-656382

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

GBHackersSep 11, 11:20 UTC · Sep 11, 2026Vulnerability 2 sourcesCVE-2026-656381 · 1 read

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

Canadian Centre for Cyber SecuritySep 10, 17:38 UTC · Sep 10, 2026AdvisoryCVE-2026-65638 CVE-2026-65639 CVE-2026-674012 · 1 read

Related CVEs

by mentions

CVE-2026-656389.2
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
published Sep 10, 2026ConfigServer Security & Firewall (CSF)
CVE-2026-67401<1%9.9
Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
published Sep 9, 2026cPanel (WebPros) cPanelPoC ×5
CVE-2026-656399.5
OS Command Injection in ConfigServer Security & Firewall (CSF) Allows Root RCE
published Sep 10, 2026ConfigServer Security & Firewall (CSF) - original distribution
CVE-2026-878999.4
Authenticated Privilege Escalation to Root RCE in cPanel & WHM
published Sep 23, 2026cPanel, L.L.C. cPanel & WHM
CVE-2026-879009.4
Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
published Sep 23, 2026Plesk / WebPros (WP Toolkit) WP Toolkit for cPanel
CVE-2026-65643<1%8.7
Authenticated eval injection in cPanel enables root code execution
published Sep 1, 2026cPanel
CVE-2026-684908.2
CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
published Sep 23, 2026cPanel (cPanel, L.L.C. / WebPros) cPanel & WHM (CalDAV/CardDAV calendar and contacts service)

Appears with

cPanelvendor · 4
WHMproduct · 3
cPanelorganization · 3
cPanelproduct · 3
WP Toolkitproduct · 1
WP Squaredproduct · 1
ConfigServer Security & Firewallvendor · 1
WebProsvendor · 1
LiteSpeed Enterpriseproduct · 1
Canadian Centre for Cyber Securityorganization · 1
cPanel & WHMproduct · 1
LiteSpeedvendor · 1
ConfigServervendor · 1

Entities are extracted by the model from each article. First seen Sep 10, 2026, last mentioned Sep 23, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.