ConfigServer ConfigServer Security & Firewall

• CVE-2026-65639 Critical 9.5 OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to in 1.4%
• CVE-2026-65638 Critical 9.2 Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. 2.3%
• CVE-2026-67402 Critical 9.2 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is block 0.5%