Critical cPanel & CSF Vulnerability Lets Attackers Run Commands

Key Takeaways

• A critical vulnerability (CVE-2026-65638) has been discovered in ConfigServer Security & Firewall (CSF).
• The flaw allows unauthenticated remote command execution via the CSF MESSENGER service.
• Versions 14.00 through 16.29 of CSF are affected.
• The vulnerability is exploitable only when the MESSENGER service is enabled and a reCAPTCHA secret is configured.
• A fix is available in CSF version 16.30 and later.

Critical CSF Vulnerability Exposes cPanel Servers to Remote Command Execution

A significant security flaw has been identified in ConfigServer Security & Firewall (CSF), a popular security plugin widely used on cPanel and WHM servers. The vulnerability, tracked as CVE-2026-65638, could enable an unauthenticated remote attacker to execute arbitrary commands on affected systems. This critical issue resides within the software’s MESSENGER service.

The vulnerability impacts CSF versions ranging from 14.00 to 16.29. Administrators are strongly urged to update their installations to CSF version 16.30 or newer immediately to mitigate the risk.

Understanding the Vulnerability

The core of the flaw lies in the CSF MESSENGER service, a feature designed to display custom messages to visitors who have been blocked by the firewall. According to the security advisory, an attacker does not need to possess any authentication credentials to exploit this vulnerable service.

Successful exploitation allows for arbitrary command execution under the privileges of the CSF service account. While this account is unprivileged and does not automatically grant root access, command execution on an internet-facing server can still lead to severe consequences. These include the potential exposure of sensitive files, network reconnaissance, establishment of persistence mechanisms, modification of hosted content, or serving as an initial foothold for more sophisticated attacks.

Conditions for Exploitation

Crucially, the vulnerable functionality is not active by default, limiting the immediate exposure for standard CSF deployments. An attacker can only reach the vulnerable code path if two specific conditions are met:

• The MESSENGER service is explicitly enabled within CSF.
• A reCAPTCHA secret has been configured for the MESSENGER service.

Since neither of these settings is enabled by default, organizations utilizing default CSF configurations may have a reduced risk profile. However, any organization that has manually enabled the MESSENGER feature to manage blocked traffic or deliver custom visitor messages should treat this vulnerability with the utmost urgency.

Given CSF’s widespread deployment, particularly on public hosting infrastructure within cPanel and WHM environments, administrators must verify their configurations even if they believe their systems adhere to default settings. CSF provides essential security controls such as firewall management, login failure detection, and IP blocking.

cPanel recommends updating the ConfigServer Firewall plugin to the latest available release. On supported operating systems, including CentOS 7, CloudLinux 7, AlmaLinux, CloudLinux 8, CloudLinux 9, CloudLinux 10, and Ubuntu, administrators can refresh packages and initiate the cPanel update process to apply the patch.

After updating, it is essential for administrators to confirm that CSF version 16.30 or a newer release is successfully installed. A review of CSF configuration settings is also advised to ensure that any unnecessary internet-facing components remain disabled.

What You Should Do

• Update Immediately: Upgrade ConfigServer Security & Firewall to version 16.30 or later. This is the primary and most effective remediation.
• Verify Version: After updating, confirm that CSF version 16.30 or a newer release is active on your server.
• Disable MESSENGER (Temporary Mitigation): If immediate patching is not possible, disable the MESSENGER service as a temporary safeguard. Connect to your server as root via SSH or WHM Terminal, edit /etc/csf/csf.conf, set MESSENGER = 0, save the file, and then restart CSF and LFD services using systemctl restart csf lfd.
• Review Configurations: Regularly audit your CSF configuration settings to ensure that only necessary services are enabled, especially those exposed to the internet.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.