ConfigServer vulnerabilities
We track 3 vulnerabilities in ConfigServer products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2026.
Latest ConfigServer vulnerabilities
- 9.5 Critical severity
ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulner
- 9.2 Critical severity
ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally
- 9.2 Critical severity
ConfigServer Security & Firewall: Files or Directories Accessible to External Parties
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary command