ConfigServer Security & Firewall vulnerabilities

3 known vulnerabilities in ConfigServer Security & Firewall from WebPros. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.5 Critical severity

  ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-65639Sep 10, 2026WebProsEPSS 1.42%

  OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulner

• 9.2 Critical severity

  ConfigServer Security & Firewall: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-65638Sep 10, 2026WebProsEPSS 2.33%

  Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally

• 9.2 Critical severity

  ConfigServer Security & Firewall: Files or Directories Accessible to External Parties

  CVE-2026-67402Sep 4, 2026WebPros

  An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary command