ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cyber Security Newspublished ()ingested Abinaya
Part of a story covered by 6 sources: “cPanel EmailTrack SQL Injection (CVE-2026-67401) Lets Mail-Privileged Accounts Run Code as Root; ConfigServer Firewall Flaw (CVE-2026-65638) Detailed, Patched in CSF 16.30” — merged summary and timeline →

cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands

highVulnerabilityimportance 55CVE-2026-65638
AI summary · glm-5.3-flash

CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.

CVE-2026-65638 affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29 and allows unauthenticated remote attackers to execute arbitrary commands through the MESSENGER service, running under the unprivileged CSF service account rather than root. Exploitation requires the non-default MESSENGER service to be enabled and a reCAPTCHA secret configured, reducing exposure for standard deployments. CSF 16.30 and later fix the flaw; administrators who cannot update immediately can set MESSENGER = 0 in /etc/csf/csf.conf as a temporary mitigation.

  • Affects CSF 14.00–16.29; fixed in version 16.30 and later
  • Exploitation requires MESSENGER enabled and a reCAPTCHA secret configured
  • Command execution runs under the unprivileged CSF service account, not root
  • Mitigation: disable MESSENGER in csf.conf and restart csf and lfd
Read the original
VendorscPanel
ProductsConfigServer Security & FirewallWHMcPanel
OrganizationscPanel
ATT&CK T1190 Exploit Public-Facing Application
Tagscpanelwhmconfigservercsfmessengerrcehosting

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-65638
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)

CVE-2026-65638 is an unauthenticated shell command injection flaw (CWE-78) in ConfigServer Security & Firewall (CSF), caused by improper escaping of a request URL. An attacker who sends a crafted request URL containing shell metacharacters to the affected web-facing component can have arbitrary commands executed under the CSF service account. Successful exploitation therefore yields command execution on the server in the context of the CSF service account, with a critical CVSS 4.0 score of 9.2 reflecting high confidentiality, integrity, and availability impact on the vulnerable system. The flaw affects versions originally distributed by ConfigServer as well as versions of the WebPros-maintained fork that contain the vulnerable code; WebPros has fixed it in version 16.30, and other independently maintained CSF forks should be evaluated separately. There is no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date.

Do: Upgrade the WebPros-maintained CSF fork to version 16.30 or later and verify which fork and version your deployment actually uses. If you run the original ConfigServer distribution or a third-party fork, monitor the respective maintainer for a patched release and assess your version independently. Until patched, restrict unauthenticated access to the CSF web interface (e.g., limit it to trusted management networks or localhost/VPN) and watch for unexpected command execution by the CSF service account.

9.2—
  • ConfigServer Security & Firewall (CSF)
  • WebPros ConfigServer Security & Firewall (WebPros-maintained fork) Versions containing the vulnerable code; fixed in version 16.30
  • Other independently maintained CSF forks May also be affected; should be evaluated independently (no version ranges or fixes provided)
masslikely on the order of 100,000+ hosting server installations (order-of-magnitude estimate; exact published counts not available)
Full article498 words · extracted from cybersecuritynews.com · click to collapse

A critical vulnerability in ConfigServer Security & Firewall (CSF), used on cPanel and WHM servers, could allow an unauthenticated remote attacker to execute arbitrary commands through the software’s MESSENGER service. The issue is tracked as CVE-2026-65638 and affects CSF versions 14.00 through 16.29.

CSF version 16.30 and later fixes the vulnerability. Administrators running affected installations should update the ConfigServer Firewall plugin immediately, especially where the MESSENGER feature has been manually enabled.

The flaw exists in the CSF MESSENGER service, a feature intended to display messages to blocked visitors. According to the security release, a remote attacker does not need to authenticate to exploit the vulnerable service.

Successful exploitation can result in arbitrary command execution under the CSF service account. This account is unprivileged, meaning the flaw does not automatically provide root-level access.

However, command execution on an internet-facing web server can still expose sensitive files, enable reconnaissance, create persistence, modify hosted content, or provide an initial foothold for further attacks.

cPanel ConfigServer Security & Firewall Vulnerability

The vulnerable functionality is not active by default. An attacker can reach the affected code only when both of these conditions are met:

  • The MESSENGER service is enabled in CSF.
  • A reCAPTCHA secret has been configured for the service.

Neither setting is enabled by default, reducing exposure for standard CSF deployments. However, organizations that enabled MESSENGER to manage blocked traffic or present custom visitor messages should treat the issue as urgent.

ProductAffected versionsPatched versions
ConfigServer Security & Firewall14.00 through 16.2916.30 and later

CSF is widely deployed with cPanel and WHM environments to provide firewall management, login-failure detection, IP blocking, and related server-security controls.

Because it often runs on public hosting infrastructure, administrators should verify whether the vulnerable service is enabled even if they believe their installation uses default settings.

cPanel recommends updating the ConfigServer Firewall plugin to the latest available release. On supported CentOS 7, CloudLinux 7, AlmaLinux, CloudLinux 8, CloudLinux 9, CloudLinux 10, and Ubuntu systems, administrators can refresh packages and invoke the cPanel update process:

After updating, administrators should confirm that CSF version 16.30 or a newer release is installed. They should also review CSF configuration settings to ensure unnecessary internet-facing components remain disabled.

Organizations that can’t update immediately can reduce exposure by turning off the MESSENGER service. Administrators should connect to the server as root through SSH or the WHM Terminal and edit the CSF configuration file:

nano /etc/csf/csf.conf

Set the following option: MESSENGER = 0

Then save the configuration and restart both CSF and the Login Failure Daemon service: 

systemctl restart csf lfd

Disabling MESSENGER removes the vulnerable attack path, but it should be considered a temporary safeguard. Installing CSF 16.30 or later remains the recommended remediation for CVE-2026-65638.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

Abinayahttps://cybersecuritynews.com/

Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.

Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/cpanel-configserver-security-firewall-vulnerability/