Security: CVE-2026-65639 CSF Security Release

Situation

A vulnerability was found in the advanced-rule parser in the ConfigServer Security & Firewall (CSF) software which could allow a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root.

Note: By default, no remote allow/deny feed is configured.

Affected Product versions

Impact

Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

Call to action

Update to the latest version of the ConfigServer Firewall plugin:

Mitigation

It is highly recommended that you update the installed CSF version as soon as possible.

This vulnerability is only reachable on servers configured to pull a remote allow or deny list. If updating is not possible, review those settings and remove any feed you do not fully control and trust.

1. Access the server as the root user via SSH, or the Terminal in WHM.

2. Edit the CSF configuration file:

   # nano /etc/csf/csf.conf

3. Review the GLOBAL_DENY and GLOBAL_ALLOW options and clear any untrusted feed URL:

   CONFIG_TEXT: GLOBAL_DENY = ""

   CONFIG_TEXT: GLOBAL_ALLOW = ""

4. Save and restart the CSF and LFD services:

   # systemctl restart csf lfd

Note: rule data from a previously configured feed is cached on disk and re-applied when the service restarts. After updating or clearing the feed settings, review the cached list at /var/lib/csf/csf.gdeny.