Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-65639

ConfigServer Security & Firewall · OS command injection

CVSS 4.0 9.5 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-65639

Published

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-65639

Published

ConfigServer Security & Firewall

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "WebPros",
                    "product": "ConfigServer Security & Firewall",
                    "versions": [
                        {
                            "version": "2.15",
                            "status": "affected",
                            "lessThan": "16.30",
                            "versionType": "semver"
                        }
                    ]
                }

ConfigServer Security & Firewall

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "ConfigServer",
                    "product": "ConfigServer Security & Firewall",
                    "versions": [
                        {
                            "version": "2.15",
                            "status": "affected",
                            "lessThan": "*",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON