← News
/DISPATCH · 2026-09-14

cPanel Urges Admins to Patch CSF: CVE-2026-65638 Command Injection, CVSS 9.2

cPanel disclosed a ConfigServer Security Firewall command-injection bug, CVE-2026-65638, CVSS 4.0 score 9.2, affecting CSF 14.00 through 16.29. With MESSENGER enabled and a reCAPTCHA key set, an unauthenticated attacker can run commands remotely.

cPanel disclosed on 10 September 2026 that the ConfigServer Security & Firewall (CSF) plugin has an OS command-injection flaw, CVE-2026-65638, scored 9.2 under CVSS 4.0. The bug is in CSF 14.00 through 16.29 as maintained by WebPros, and is fixed in 16.30 and later. cPanel tells admins to move to the latest release now. If you cannot upgrade immediately, disable the exposed MESSENGER service.

Incident overview

CSF is a third-party plugin on Linux hosts for firewall rules and login-failure monitoring. It is widely deployed on cPanel and WHM. The issue is CWE-78 OS command injection: the request URL is not escaped before it enters a shell command. No credentials required. Commands run as the CSF service account. cPanel says that account is limited, but impact on host confidentiality, integrity, and availability can still be severe. The Canadian Centre for Cyber Security also listed the bug in its 10 September WebPros security advisory.

Technical details

The reachable surface is narrower than the score. cPanel says the vulnerable path is live only when CSF MESSENGER is enabled and a reCAPTCHA key is configured. Both are off by default. A stock install that never turned the service on is not directly exploitable on this path. Do not assume you are safe — check the config. Any host that uses MESSENGER to serve a block page to denied visitors, with the interface reachable from the network, is in the check set.

Watch version range and forks. The CVE notes the defective code also lived in software originally shipped by ConfigServer, and may remain in independently maintained forks. Those forks do not automatically receive cPanel's fix. CSF's original vendor ended maintenance on 31 August 2025 and released the code under GPLv3. WebPros now maintains a security branch for supported cPanel and WHM versions. Separately, 16.31-1, shipped 3 September, is a targeted security build for another MESSENGER-related code-execution issue, CVE-2026-67402, affecting 16.30-1 and earlier. Do not stop at the minimum version for one CVE. Go to the latest release.

Impact

CISA supplemental data marks in-the-wild exploitation as none at disclosure. Network-reachable, unauthenticated, no user interaction, plus shared-hosting use of CSF for rule management and login-failure blocking, still matter. A successful hit runs commands as the service account and sets up privilege escalation and lateral movement. On a VPS/shared host, one box often carries many customer sites. Blast radius scales with that.

Remediation

References