Critical CSF Vulnerability (CVE-2026-65638) Enables Remote Command Execution on cPanel Servers A severe vulnerability in ConfigServer Security & Firewall (CSF), a widely used security plugin for cPanel and WHM servers, allows unauthenticated remote attackers to execute arbitrary commands via the software’s MESSENGER service. Tracked as CVE-2026-65638, the flaw affects CSF versions 14.00 through 16.29 and has been patched in version 16.30 and later. The vulnerability resides in the MESSENGER service, a feature designed to display messages to blocked visitors. Exploitation requires no authentication, though the attack surface is limited to environments where: - The MESSENGER service is manually enabled in CSF. - A reCAPTCHA secret is configured for the service. Neither condition is active by default, reducing risk for standard deployments. However, organizations using MESSENGER for custom visitor messages or blocked traffic management face urgent exposure. Successful exploitation grants command execution under the unprivileged CSF service account, which does not provide root access but can still enable: - Sensitive data exposure (e.g., file access). - Reconnaissance for further attacks. - Persistence mechanisms or hosted content modification. - Initial footholds for lateral movement. CSF is commonly deployed in public hosting environments, where it manages firewall rules, login-failure detection, and IP blocking. Administrators are advised to verify MESSENGER’s status even in default installations, as misconfigurations may exist. Remediation Steps: - Update CSF to version 16.30 or later via cPanel’s package refresh on supported systems (CentOS 7, CloudLinux, AlmaLinux, Ubuntu). - Disable MESSENGER temporarily by setting `MESSENGER = 0` in `/etc/csf/csf.conf` and restarting CSF (`systemctl restart csf lfd`), though patching remains the recommended fix. The flaw underscores the risks of internet-facing security tools with optional, non-default features particularly in shared hosting environments where CSF is prevalent.