CVE-2026-65638

No known exploitation. EPSS puts it in the 83rd percentile. No fix published yet.

CVSS —Not scored EPSS percentile83rd2.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-10Updated 2026-09-10Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the installed ConfigServer Security & Firewall version on every managed server.
Upgrade ConfigServer Security & Firewall to version 16.30.
If you cannot upgrade promptly, restrict access to its web-facing interface to trusted administrator networks and review the server for unexpected commands or accounts.

Usually a quick update

What it is

From the CVE record

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

In plain language

Written by AI from the record

ConfigServer Security & Firewall has a serious remote break-in flaw; businesses running a version earlier than 16.30 should treat it as urgent.

Unauthenticated network-based shell command injection (CWE-78) allows arbitrary command execution as the CSF service account through improperly escaped request URLs.

If you're affected

Server command execution
Security controls bypassed
Sensitive data exposure
Service disruption
Ransomware risk

What is it

A flaw in ConfigServer Security & Firewall can let an outsider send a specially written web request that makes the server run their commands. It is like an attacker slipping instructions into a security guard’s paperwork and having the guard carry them out.

Who is affected

This matters to you if you use or run ConfigServer Security & Firewall on a server. The risk is greatest where its web-accessible functions can be reached over the network; no attacker login or employee action is required.

How urgent is it

This is urgent because an attacker can remotely take actions on the server without signing in. Although there is no confirmed real-world exploitation or public exploit code in the findings, the flaw is likely reachable in a default setup and can lead directly to server command execution.

What to do — in detail

Confirm the installed ConfigServer Security & Firewall version on each server and identify whether its web-facing functions are reachable from untrusted networks. Upgrade to version 16.30, including installations based on the WebPros-maintained fork that contain the vulnerable code; independently maintained forks should be evaluated separately because their patch status is not yet known.

If upgrading must wait, limit the relevant web access to trusted administrator networks and remove public exposure where practical. Afterward, review CSF-related web and system logs for unusual requests, unexpected command execution, newly created accounts, unfamiliar scheduled tasks, or configuration changes. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date is provided.

Technical context

CVE-2026-65638 is CWE-78 shell command injection over the network. A crafted request URL is improperly escaped, enabling unauthenticated arbitrary command execution under the CSF service account; user interaction is not required, and default reachability is considered likely. No public exploit code is on record, no dated report confirms exploitation, and it is not listed in CISA KEV. EPSS estimates a 3.2% likelihood (88th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS83rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.3% chance of exploitation activity in the next 30 days, which ranks it in the 83rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 0 days, from the signal feeds we watch.

2026-09-10Publishedweakness classified, att&ck mapped, record updated

Affected products

WebProscommercial · USaka cpanel, wp squared
- ConfigServer Security & FirewallMixedCloud & SaaS / cloud-platform
ConfigServeross-project · USaka configserver security firewall, csf
- ConfigServer Security & FirewallOn-premSecurity Products

Technical detail

Weaknesses

CWE-78No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

ExecutionT1059Command and Scripting Interpreterhigh confidence

Sources

References in the record

support.cpanel.net/hc/en-us/articles/43387915588375-Security-CVE-2026-65638-CSF-Security-Release

In the news

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · 2026-09-21

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for WebPros, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account