CVE-2026-65638Patch

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 4 signals
Peaked 1d ago at 2 mentions (2026-09-11); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification1 categories

Patch

4100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-10	1	Patch1
2026-09-11	2	Patch2
2026-09-18	1	Patch1

Full discourse4 posts

Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 CSF'de iki yeni RCE açığı: CVE-2026-65638 & CVE-2026-65639 ConfigServer Security & Firewall için cPanel tarafından yayınlanan güvenlik güncellemesi, iki farklı RCE açığını gideriyor. CVE-2026-65639 Advanced-rule parser'daki açık, saldırganın kontrol ettiği bir remote allow/deny feed üzerinden arbitrary command execution gerçekleştirmesine ve root yetkisiyle kod çalıştırmasına neden olabiliyor. CVE-2026-65638 MESSENGER servisindeki açık, kimlik doğrulama gerektirmeden uzaktan arbitrary command execution yapılmasına izin verebiliyor. Kod, CSF service account yetkileriyle çalışıyor. Her iki açık da CSF 16.29 ve öncesi sürümleri etkiliyor. Güvenlik açıkları 16.30+ sürümünde giderildi. https://support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release https://support.cpanel.net/hc/en-us/articles/43387923160343-Security-CVE-2026-65639-CSF-Security-Release
Post summary
The post announces two RCE vulnerabilities in ConfigServer Security & Firewall, explains how they allow arbitrary command execution, and confirms that they are fixed in version 16.30+ with vendor advisory links.
000551.0K
2.4K followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
Two critical CSF plugin vulnerabilities, CVE-2026-65638 and CVE-2026-65639, allow remote code execution. Patch your ConfigServer firewall immediately. #CSFPlugin #Cybersecurity #CVE202665639 #Vulnerabilities #InfoSec https://securityonline.info/csf-plugin-vulnerabilities-cvss-9-5/
Post summary
The post warns of two critical CSF plugin remote‑code‑execution CVEs and urges immediate patching of ConfigServer firewall, with no evidence of active exploitation or exploit availability.
02041438
13.0K followersView on X
CCB Alert@CCBalert45d
Patch
Warning: Critical SQL injection and OS command injection flaws in #cPanel WHM and #CSF allow root remote code execution. #RCE CVE-2026-67401 CVSS:9.9 CVE-2026-65639 CVSS:9.5 CVE-2026-65638 CVSS:9.2. Read our advisory: https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-cpanel-whm-and-configserver-security-firewall and #Patch #Patch #Patch
Post summary
The post warns of critical SQL injection and OS command injection vulnerabilities in cPanel WHM and CSF, lists CVE IDs with high CVSS scores, and urges users to apply patches via the provided advisory link.
00001316
7.2K followersView on X
iototsecnews@iototsecnews39d
Patch
cPanel の脆弱性 CVE-2026-65638 が FIX：任意のコード実行の可能性 https://iototsecnews.jp/2026/09/11/cpanel-urges-users-to-patch-configserver-firewall-remote-code-execution-flaw/ cPanel 環境等で広く導入される ConfigServer Security & Firewall (CSF) の脆弱性 CVE-2026-65638 を解説する記事です。特定機能を有効化している場合、未認証の第三者にサービス権限でコマンドを実行される恐れがあり、システム内の偵察／データアクセス／横展開の足掛かり利用などの影響が生じます。対応策としては、16.30 以降へのアップデート／直ちに変更できない場合の MESSENGER 機能の無効化／設定後のサービス再起動が求められます。運用中のサーバーにおける導入状況の確認と迅速なパッチ適用が推奨されます。 #cPanel #CVE202665638 #Vulnerability
Post summary
The article explains that CVE-2026-65638 in ConfigServer Security & Firewall could allow unauthenticated remote code execution and recommends updating to version 16.30+ or disabling the Messenger feature as a workaround.
0000091
515 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-65638

Rıdvan Yağlı[verified]@ridvanyagliPatch

The post announces two RCE vulnerabilities in ConfigServer Security & Firewall, explains how they allow arbitrary command execution, and confirms that they are fixed in version 16.30+ with vendor advisory links.

Daily CyberSecurity@Daily_CyberSecPatch

The post warns of two critical CSF plugin remote‑code‑execution CVEs and urges immediate patching of ConfigServer firewall, with no evidence of active exploitation or exploit availability.

CCB Alert@CCBalertPatch

The post warns of critical SQL injection and OS command injection vulnerabilities in cPanel WHM and CSF, lists CVE IDs with high CVSS scores, and urges users to apply patches via the provided advisory link.

iototsecnews@iototsecnewsPatch

The article explains that CVE-2026-65638 in ConfigServer Security & Firewall could allow unauthenticated remote code execution and recommends updating to version 16.30+ or disabling the Messenger feature as a workaround.