CRITICAL 9.2 NVD

CVE-2026-65638

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF servi

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

References

https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Se

Published: 2026-09-10 · Source: NVD · Feed updated: 2026-09-11

This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-10 via NVD.

Risk Timeline

CVE Disclosed2026-09-10 · 0 days ago

Remediation Resources

Official Advisory

support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.