CVE-2026-65638

Published: Sep 10, 2026Updated: Sep 10, 2026 Sources: CVE List NVDCWE-78

N/ACVSS

NVD MITRE

EPSS Score

Description

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

In plain language

AI Act now

ConfigServer Security & Firewall has a serious remote break-in flaw; businesses running a version earlier than 16.30 should treat it as urgent.

Executive summary

Unauthenticated network-based shell command injection (CWE-78) allows arbitrary command execution as the CSF service account through improperly escaped request URLs.

If affected, business impact

Server command executionSecurity controls bypassedSensitive data exposureService disruptionRansomware risk

What to do now

Check the installed ConfigServer Security & Firewall version on every managed server.
Upgrade ConfigServer Security & Firewall to version 16.30.
If you cannot upgrade promptly, restrict access to its web-facing interface to trusted administrator networks and review the server for unexpected commands or accounts.

Usually a quick update

What is it

A flaw in ConfigServer Security & Firewall can let an outsider send a specially written web request that makes the server run their commands. It is like an attacker slipping instructions into a security guard’s paperwork and having the guard carry them out.

Who is affected

This matters to you if you use or run ConfigServer Security & Firewall on a server. The risk is greatest where its web-accessible functions can be reached over the network; no attacker login or employee action is required.

How urgent is it

This is urgent because an attacker can remotely take actions on the server without signing in. Although there is no confirmed real-world exploitation or public exploit code in the findings, the flaw is likely reachable in a default setup and can lead directly to server command execution.

What to do — in detail

Confirm the installed ConfigServer Security & Firewall version on each server and identify whether its web-facing functions are reachable from untrusted networks. Upgrade to version 16.30, including installations based on the WebPros-maintained fork that contain the vulnerable code; independently maintained forks should be evaluated separately because their patch status is not yet known.

If upgrading must wait, limit the relevant web access to trusted administrator networks and remove public exposure where practical. Afterward, review CSF-related web and system logs for unusual requests, unexpected command execution, newly created accounts, unfamiliar scheduled tasks, or configuration changes. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date is provided.

Technical context

CVE-2026-65638 is CWE-78 shell command injection over the network. A crafted request URL is improperly escaped, enabling unauthenticated arbitrary command execution under the CSF service account; user interaction is not required, and default reachability is considered likely. No public exploit code is on record, no dated report confirms exploitation, and it is not listed in CISA KEV. EPSS estimates a 3.2% likelihood (88th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Weaknesses

CWE-78

Affected Products

WebPros

commercial·USaka wp squared, cpanel

ConfigServer Security & FirewallMixed

Cloud & SaaS / cloud-platform

ConfigServer

oss-project·USaka configserver security firewall, csf

ConfigServer Security & FirewallOn-prem

Security Products

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Execution

View detailed technique mapping

References

https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release

support.cpanel.net

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-65638 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows