CVE-2026-65639
This vulnerability allows a remote attacker to run arbitrary commands as root on a system running ConfigServer Security & Firewall. The flaw is in the advanced-rule parser, which fails to validate data from an allow/deny feed. An attacker who can control that feed can execute any command with root privileges.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
ConfigServer Security & Firewall (CSF) versions before 16.30, including the original ConfigServer distribution and the WebPros fork. Other forks or independently maintained versions that contain the same code may also be affected.
Real-world impact
An attacker who can supply a malicious allow/deny feed can run any command as root, giving them full control over the affected system.
Why this severity
The CVSS score of 9.5 reflects the high impact of the vulnerability: it allows remote exploitation with no authentication, and the attacker can execute arbitrary commands as root, leading to complete system compromise.
What to do about it
- 01Upgrade ConfigServer Security & Firewall to version 16.30 or later.
- 02Restart the CSF service to apply the update.
NVD-referenced vendor advisory
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.