CVE-2026-67402CWE-552

CVE-2026-67402

published September 4, 2026

CVSS
9.2
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
EPSS
0.00322 · 24.8th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-09-04T04:17Z
References (1)
https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:43Z
    EPSS moved — → 0%
    epss
  • 03 SEP 23:57Z
    An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host
    cvelistv5