Security: CVE-2026-65638 CSF Security Release

Situation

A vulnerability was found in the MESSENGER service in the ConfigServer Security & Firewall (CSF) software which could allow an unauthenticated remote attacker to execute arbitrary commands as the CSF service account.

Note: By default, the MESSENGER service is disabled.

Affected Product versions

Impact

Exploiting this could lead to unauthenticated remote code execution as an unprivileged service account.

Call to action

Update to the latest version of the ConfigServer Firewall plugin:

Mitigation

It is highly recommended that you update the installed CSF version as soon as possible.

This vulnerability is only reachable when the MESSENGER service is enabled and a reCAPTCHA secret is configured. Neither is enabled by default.

If updating is not possible, you can disable the MESSENGER service in CSF.

1. Access the server as the root user via SSH, or the Terminal in WHM.

2. Edit the CSF configuration file:

   # nano /etc/csf/csf.conf

3. Update the MESSENGER option to be disabled:

   CONFIG_TEXT: MESSENGER = 0

4. Save and restart the CSF and LFD services:

   # systemctl restart csf lfd