cPanel presses CSF users to close critical flaw

cPanel has urged server administrators to update ConfigServer Security & Firewall after disclosure of a critical command-injection vulnerability that can let unauthenticated remote attackers run arbitrary commands on affected systems under specific service configurations.

The flaw, tracked as CVE-2026-65638, affects cPanel’s WebPros-maintained CSF versions 14.00 through 16.29 and was addressed in version 16.30 and later. cPanel said administrators should move to the latest available release as soon as possible, while those unable to update should disable the vulnerable MESSENGER service.

The vulnerability carries a CVSS 4.0 score of 9.2 out of 10, placing it in the critical category. The published CVE record classifies the weakness as CWE-78, or operating system command injection, caused by improper escaping of a request URL before it reaches a shell command.

Successful exploitation could allow an attacker without credentials to execute commands as the CSF service account. cPanel said that account is unprivileged, limiting the immediate execution context, but the flaw can still expose the affected host to serious confidentiality, integrity and availability risks.

Exposure is narrower than the severity score alone may suggest. cPanel said the vulnerable path is reachable only when CSF’s MESSENGER service is enabled and a reCAPTCHA secret has been configured. Neither setting is enabled by default, meaning standard installations that have not activated the service are not directly exposed through this route.

Administrators nevertheless need to verify their configurations rather than assume they are safe. Servers using MESSENGER for blocked visitors or other configured responses should be checked, particularly where the interface can be reached over a network. The vulnerability does not require authentication or user interaction once the necessary service conditions are present.

cPanel’s advisory recommends updating through the operating system’s package-management process and its package update script. For systems where patching cannot be completed immediately, administrators can set the MESSENGER option to zero in the CSF configuration file and restart the CSF and Login Failure Daemon services.

The CVE record says the vulnerable code also existed in software originally distributed by ConfigServer and may persist in independently maintained forks. It advises operators of forks outside the WebPros-maintained branch to evaluate them separately rather than assume the cPanel fix automatically applies.

That distinction has become important since the original CSF developers ended maintenance and support on August 31, 2025 and released the software under the GPLv3 licence. WebPros International, cPanel’s parent company, now maintains its own CSF version for security and stability updates on supported cPanel and WHM releases.

CSF is a third-party firewall management plugin commonly deployed on Linux hosting servers. Within cPanel and WHM environments, it provides administrators with controls for firewall rules and related security functions, including login-failure monitoring and network access restrictions.

The September 10 disclosure follows other security work affecting CSF. cPanel released version 16.30-1 in August to address several vulnerabilities that could, in some circumstances, lead to root access. A targeted 16.31-1 security release was issued on September 3 for another MESSENGER-related code-execution issue tracked separately as CVE-2026-67402.

That separate flaw affects CSF 16.30-1 and older versions and can allow code execution as the Apache user when the MESSENGERV3 feature is involved. cPanel advises customers to run the latest CSF package rather than stopping at a minimum version associated with one vulnerability.

Canada’s Cyber Centre also listed CVE-2026-65638 in a September 10 WebPros security advisory and encouraged administrators to review vendor guidance and apply necessary updates. Its notice identified CSF versions 14.00 through 16.29 as affected by the command-injection flaw.

The CVSS vector records low attack complexity but notes that attack requirements are present, reflecting the need for the MESSENGER and reCAPTCHA configuration. It assigns high impact to confidentiality, integrity and availability on the vulnerable system, while CISA’s assessment marked exploitation as none and automation as no.

CISA’s enrichment data accompanying the CVE listed no known exploitation at the time of publication. That status does not alter the patch recommendation, because the vulnerability is network-reachable, needs no privileges and requires no user interaction when its configuration prerequisites are satisfied.