Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw (CVE-2026-65638)

2 sources · 2 articlesFirst reported Updated ()3 · 1 read
What's new

This is the first merged summary for this story: cPanel is urging administrators to patch CVE-2026-65638, and CSF version 16.30 has been released to fix the flaw in versions 14.00-16.29.

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00-16.29 lets unauthenticated remote attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; updating to CSF 16.30 or later fixes the flaw.

CVE-2026-65638 affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29 and allows unauthenticated remote attackers to execute arbitrary commands through the MESSENGER service. Exploitation is only possible when the non-default MESSENGER service is enabled and a reCAPTCHA secret has been configured, reducing exposure for standard deployments. Successful exploitation yields command execution under the unprivileged CSF service account (not root), providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 and later fix the issue; administrators who cannot update immediately can set MESSENGER = 0 in /etc/csf/csf.conf and restart csf and lfd as a temporary mitigation. Both sources reporting on the flaw agree on the affected versions, exploitation prerequisites, and fix version.

Key facts
  • Vulnerability tracked as CVE-2026-65638
  • Affects ConfigServer Security & Firewall (CSF) versions 14.00 through 16.29
  • Allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service
  • Exploitation requires both MESSENGER enabled (a non-default setting) and a reCAPTCHA secret configured
  • Command execution runs under the unprivileged CSF service account, not root by default
  • Fixed in CSF 16.30 and later
  • Temporary mitigation: set MESSENGER = 0 in /etc/csf/csf.conf and restart csf and lfd
  • Impacts internet-facing cPanel/WHM hosting infrastructure
Analyze CVE-2026-65638 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-65638
Vendors
cPanel
Products
ConfigServer Security & FirewallWHMcPanel
Organizations
cPanel

Coverage

oldest first · one row per article · UTC
  1. · Sep 11, 2026 GBHackersFirst report

    cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

    cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

  2. · Sep 11, 2026 Cyber Security News

    cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands

    CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-65638
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
9.2—