CVE-2026-65639CWE-78command-injection

CVE-2026-65639

published September 10, 2026

CVSS
9.5
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.

The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

The record
Technical detail
CVSS
9.5 · NONE
CVSS v4.0
9.5 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01419 · 72.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-10T21:17Z
References (1)
https://support.cpanel.net/hc/en-us/articles/43387923160343-Security-CVE-2026-65639-CSF-Security-Release · [email protected]
EPSS history
Timeline
  • 12 SEP 03:21Z
    EPSS moved — → 2%
    epss
  • 10 SEP 16:24Z
    OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to…
    cvelistv5