cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw
cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.
CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.
- Affects CSF 14.00–16.29; patch to version 16.30 or later
- Requires both MESSENGER enabled and a configured reCAPTCHA secret
- Runs as unprivileged CSF service account, no root by default
- Temporary mitigation: set MESSENGER = 0 and restart csf and lfd
- CVEs
- CVE-2026-65638
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65638 | Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF) | 9.2 | — |
From the original article
2 min read at gbhackers.com
A recently disclosed vulnerability in ConfigServer Security & Firewall (CSF) could allow unauthenticated remote attackers to execute arbitrary commands through the product’s MESSENGER service. This vulnerability, tracked as CVE-2026-65638, affects CSF versions 14. 00 through 16.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.