Volver a los avisos de seguridad

Security: CVE-2026-65639 CSF Security Release

CloudLinux, cPanel, CSF is affected by CVE-2026-65639. OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Critical
CloudLinux cPanel CSF CentOS 7 CloudLinux 7 CloudLinux 8

Comandos de corrección

EL7 (CentOS/CloudLinux 7)

sudo yum update

EL8+ (AlmaLinux/CloudLinux/Rocky)

sudo dnf update

Lo que esto significa bajo una licencia de SharedLicense

Your SharedLicense license itself is not affected — this is a vulnerability in CloudLinux, cPanel, CSF software, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell CloudLinux, cPanel, CSF under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.

Situation

A vulnerability was found in the advanced-rule parser in the ConfigServer Security & Firewall (CSF) software which could allow a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root.

Note: By default, no remote allow/deny feed is configured.

Affected Product versions

Product Affected Versions Patched Versions
CSF 2.15 through 16.29 16.30+

Impact

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

Call to action

Update to the latest version of the ConfigServer Firewall plugin:

CentOS 7/CloudLinux 7

# yum clean all

# /scripts/update-packages

AlmaLinux/CloudLinux 8/9/10

# dnf clean all

# /scripts/update-packages

Ubuntu

# apt update

# /scripts/update-packages

Mitigation

It is highly recommended that you update the installed CSF version as soon as possible.

This vulnerability is only reachable on servers configured to pull a remote allow or deny list. If updating is not possible, review those settings and remove any feed you do not fully control and trust.

  1. Access the server as the root user via SSH, or the Terminal in WHM.

  2. Edit the CSF configuration file:

    # nano /etc/csf/csf.conf

  3. Review the GLOBAL_DENY and GLOBAL_ALLOW options and clear any untrusted feed URL:

    CONFIG_TEXT: GLOBAL_DENY = “”

    CONFIG_TEXT: GLOBAL_ALLOW = “”

  4. Save and restart the CSF and LFD services:

    # systemctl restart csf lfd

Note: rule data from a previously configured feed is cached on disk and re-applied when the service restarts. After updating or clearing the feed settings, review the cached list at /var/lib/csf/csf.gdeny.

 

Preguntas frecuentes

What is CVE-2026-65639?
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
Is CVE-2026-65639 being exploited in the wild?
No confirmed exploitation has been announced. Patch on your normal schedule and watch the vendor advisory for updates.
How do I fix CVE-2026-65639?
Update CloudLinux, cPanel, CSF to the patched release.Then confirm the running version matches the patched release listed above.

Referencias

Avisos de seguridad

Avisos relacionados

Security: CVE-2026-65638 CSF Security Release

2026-09-10

cPanel CVE-2026-67401: A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as

2026-09-09 00:00:00

Security: Privilege Escalation via Phusion Passenger’s Watchdog API

2026-09-08

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema