What’s Vulnerable › Vulnerabilities
CVE-2026-65639
- Severity: critical (CVSS 9.5 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-10 · updated 2026-09-10
- Weakness: CWE-78
Description
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
Affected products
- ConfigServer Security & Firewall: from 2.15
- WebPros ConfigServer Security & Firewall: from 2.15 before 16.30 — fixed in 16.30
How to fix
Upgrade to a fixed version: WebPros ConfigServer Security & Firewall 16.30. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-65639 or the next vulnerability affects your stack