Critical severity · published Sep 3, 2026
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host
9.2
CVSS
0.5%
EPSS
No
On KEV
Description
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
ConfigServer Security & Firewall · WebPros
14.02 before 16.31 · source: vendor
Affected product
CS
ConfigServer Security & Firewall
ConfigServer
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67402
support.cpanel.net
https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026
More from ConfigServer Security & Firewall
9.5
CVE-2026-65639
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary…
9.2
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via…
–
CVE-2011-5033
Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when running on a DirectAdmin server, allows local users to cause a denial of service…