CVE-2026-67402

State: Published
Severity: 9.2 Critical
Published: Sep 3, 2026
Updated: Sep 4, 2026
Reserved: Jul 29, 2026

Description

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N	hackerone

Weaknesses

CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
ConfigServer Security & FirewallWebPros	14.02 to before 16.31Affected
ConfigServer Security & FirewallConfigServer	14.02 and laterAffected

References

https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.