What’s Vulnerable › Vulnerabilities

CVE-2026-67402

• Severity: critical (CVSS 9.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-09
• Weakness: CWE-552

Description

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Affected products

• ConfigServer Security & Firewall: from 14.02
• WebPros ConfigServer Security & Firewall: from 14.02 before 16.31 — fixed in 16.31

How to fix

Upgrade to a fixed version: WebPros ConfigServer Security & Firewall 16.31. Check the vendor advisory for mitigations.

References

• https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026

Get alerted when CVE-2026-67402 or the next vulnerability affects your stack