GBHackerspublished Sep 11, 11:20 UTC (5d ago)ingested Sep 11, 11:36 UTCDivya

Part of a story covered by 3 sources: “WebPros advisory AV26-908: cPanel EmailTrack SQL injection (CVE-2026-67401) and ConfigServer Firewall RCE (CVE-2026-65638) require updates” — merged summary and timeline →

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

highVulnerabilityimportance 55CVE-2026-65638

AI summary · glm-5.3-flash

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.

Affects CSF 14.00–16.29; patch to version 16.30 or later
Requires both MESSENGER enabled and a configured reCAPTCHA secret
Runs as unprivileged CSF service account, no root by default
Temporary mitigation: set MESSENGER = 0 and restart csf and lfd

Read the original

VendorscPanel

ProductsConfigServer Security & Firewall WHM cPanel

OrganizationscPanel

ATT&CK T1190 Exploit Public-Facing Application

Tagscpanel csf configserver firewall rce hosting patching

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-65638	Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF) CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date. Do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.	9.2	—		ConfigServer Security & Firewall (CSF) WebPros ConfigServer Security & Firewall (WebPros-maintained fork) Versions containing the vulnerable code; fixed in version 16.30 Other independently maintained CSF forks May also be affected; should be evaluated independently (no version ranges or fixes provided)	masslikely on the order of 100,000+ hosting server installations (order-of-magnitude estimate; exact published counts not available)	5d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-65638

Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)

CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.

Do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.

9.2

—

ConfigServer Security & Firewall (CSF)
WebPros ConfigServer Security & Firewall (WebPros-maintained fork) Versions containing the vulnerable code; fixed in version 16.30
Other independently maintained CSF forks May also be affected; should be evaluated independently (no version ranges or fixes provided)

masslikely on the order of 100,000+ hosting server installations (order-of-magnitude estimate; exact published counts not available)

5d ago

Full article458 words · extracted from gbhackers.com · click to collapse

A recently disclosed vulnerability in ConfigServer Security & Firewall (CSF) could allow unauthenticated remote attackers to execute arbitrary commands through the product’s MESSENGER service.

This vulnerability, tracked as CVE-2026-65638, affects CSF versions 14.00 through 16.29 and has been addressed in version 16.30 and later.

CSF is widely used on Linux servers and in cPanel/WHM environments to manage firewall rules, intrusion detection alerts, login-failure monitoring, and security automation.

Although exploiting this vulnerability does not grant root-level control, an attacker could execute commands under the CSF service account. This access could help the attacker establish a foothold for reconnaissance, data access, lateral movement, or further privilege escalation.

ConfigServer Firewall RCE Flaw

The flaw lies in CSF’s MESSENGER service, an optional feature that displays customizable messages to blocked users or visitors. The attack vector is exposed only when two specific configuration conditions are met:

The MESSENGER service is enabled.
A reCAPTCHA secret has been configured.

Neither setting is enabled by default, which reduces the number of potentially exposed servers. However, administrators who have enabled MESSENGER for custom block-page handling or visitor messaging should treat this issue as urgent, especially for internet-facing hosting infrastructure.

According to the advisory, a remote attacker does not need to authenticate to exploit the vulnerable service. This makes the flaw particularly significant for shared hosting providers, managed-service environments, and organizations using CSF across multiple cPanel servers.

Affected and Fixed Versions

Product	Vulnerable versions	Patched version
ConfigServer Security & Firewall	14.00–16.29	16.30+

Administrators should upgrade to the latest available CSF release rather than merely applying a workaround. For CentOS 7, CloudLinux 7, AlmaLinux, CloudLinux 8/9/10, and Ubuntu-based deployments, the vendor recommends refreshing packages and executing the standard update procedure:

yum clean all
/scripts/update-packages

After updating, teams should verify the installed CSF version and assess whether the MESSENGER feature is necessary in their environment.

Mitigation Steps

Organizations unable to update immediately can reduce exposure by turning off the MESSENGER service. Administrators should log in to the affected server as root through SSH or the WHM Terminal, and then edit the CSF configuration file:

nano /etc/csf/csf.conf

Set the following option:

MESSENGER = 0

After saving the configuration, restart the CSF and Login Failure Daemon services:

systemctl restart csf lfd

Security teams should also audit internet-facing servers for CSF installations, identify systems running versions earlier than 16.30, and check whether the MESSENGER and reCAPTCHA settings are enabled. Given that this flaw allows unauthenticated command execution, patching exposed systems should take precedence over routine maintenance.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/cpanel-urges-users-to-patch-configserver-firewall/