Insecure Apache Configuration in ConfigServer Security & Firewall
CVE-2026-67402

9.2CRITICAL

Key Information:

Vendor

Webpros

Status
Configserver Security & Firewall
Vendor
CVE Published:
3 September 2026

What is CVE-2026-67402?

An insecure configuration in the Apache web server utilized by ConfigServer Security & Firewall allows remote unauthenticated attackers to execute arbitrary commands as the Apache user. This vulnerability arises when the Messenger v3 module is enabled in HTTPS mode, which mistakenly maps /usr/bin to CGI executables. This configuration flaw could lead to serious compromises, especially if the attacker's IP address is blocked yet they can still interact with the vulnerable configuration. WebPros has resolved the issue in version 16.31.

Affected Version(s)

ConfigServer Security & Firewall 14.02 < 16.31

ConfigServer Security & Firewall 14.02

References

https://support.cpanel.net/hc/en-us/articles/431719587164...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.