Vulnerability · Published Sep 10, 2026 · Assigned by hackerone
CVE-2026-65639
Critical 9.5
In plain English
A critical-severity OS command injection in ConfigServer Security & Firewall from ConfigServer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Official description
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WebPros | ConfigServer Security & Firewall | 2.15 – before 16.30 |
| ConfigServer | ConfigServer Security & Firewall | 2.15 – before * |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H