cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands
CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.
CVE-2026-65638 affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29 and allows unauthenticated remote attackers to execute arbitrary commands through the MESSENGER service, running under the unprivileged CSF service account rather than root. Exploitation requires the non-default MESSENGER service to be enabled and a reCAPTCHA secret configured, reducing exposure for standard deployments. CSF 16.30 and later fix the flaw; administrators who cannot update immediately can set MESSENGER = 0 in /etc/csf/csf.conf as a temporary mitigation.
- Affects CSF 14.00–16.29; fixed in version 16.30 and later
- Exploitation requires MESSENGER enabled and a reCAPTCHA secret configured
- Command execution runs under the unprivileged CSF service account, not root
- Mitigation: disable MESSENGER in csf.conf and restart csf and lfd
- CVEs
- CVE-2026-65638
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65638 | Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF) | 9.2 | — |
From the original article
2 min read at cybersecuritynews.com
A critical vulnerability in ConfigServer Security & Firewall (CSF), used on cPanel and WHM servers, could allow an unauthenticated remote attacker to execute arbitrary commands through the software’s MESSENGER service. The issue is tracked as CVE-2026-65638 and affects CSF versions 14. 00 through 16.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.