Volver a los avisos de seguridad

Security: CVE-2026-65638 CSF Security Release

CloudLinux, cPanel, CSF is affected by CVE-2026-65638. Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Critical
CloudLinux cPanel CSF CentOS 7 CloudLinux 7 CloudLinux 8

Comandos de corrección

EL7 (CentOS/CloudLinux 7)

sudo yum update

EL8+ (AlmaLinux/CloudLinux/Rocky)

sudo dnf update

Lo que esto significa bajo una licencia de SharedLicense

Your SharedLicense license itself is not affected — this is a vulnerability in CloudLinux, cPanel, CSF software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell CloudLinux, cPanel, CSF under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Situation

A vulnerability was found in the MESSENGER service in the ConfigServer Security & Firewall (CSF) software which could allow an unauthenticated remote attacker to execute arbitrary commands as the CSF service account.

Note: By default, the MESSENGER service is disabled.

Affected Product versions

Product Affected Versions Patched Versions
CSF 14.00 through 16.29 16.30+

Impact

Exploiting this could lead to unauthenticated remote code execution as an unprivileged service account.

Call to action

Update to the latest version of the ConfigServer Firewall plugin:

CentOS 7/CloudLinux 7

# yum clean all

# /scripts/update-packages

AlmaLinux/CloudLinux 8/9/10

# dnf clean all

# /scripts/update-packages

Ubuntu

# apt update

# /scripts/update-packages

Mitigation

It is highly recommended that you update the installed CSF version as soon as possible.

This vulnerability is only reachable when the MESSENGER service is enabled and a reCAPTCHA secret is configured. Neither is enabled by default.

If updating is not possible, you can disable the MESSENGER service in CSF.

  1. Access the server as the root user via SSH, or the Terminal in WHM.

  2. Edit the CSF configuration file:

    # nano /etc/csf/csf.conf

  3. Update the MESSENGER option to be disabled:

    CONFIG_TEXT: MESSENGER = 0

  4. Save and restart the CSF and LFD services:

    # systemctl restart csf lfd

 

Preguntas frecuentes

What is CVE-2026-65638?
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
Is CVE-2026-65638 being exploited in the wild?
No confirmed exploitation has been announced. Patch on your normal schedule and watch the vendor advisory for updates.
How do I fix CVE-2026-65638?
Update CloudLinux, cPanel, CSF to the patched release.Then confirm the running version matches the patched release listed above.

Referencias

Avisos de seguridad

Avisos relacionados

Security: CVE-2026-65639 CSF Security Release

2026-09-10

cPanel CVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as

2026-09-09 00:00:00

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema