CVE-2026-65639 – WebPros ConfigServer Security & Firewall

WebPros has fixed two critical command injection flaws in ConfigServer Security & Firewall (CSF) in version 16.30. CVE-2026-65638 has a CVSS score of 9.2, Critical severity. Because CSF does not properly escape a request URL, an unauthenticated remote attacker can run any command as the CSF service account. CVE-2026-65639 has a CVSS score of 9.5, Critical severity. Its advanced-rule parser does not properly check rule data from feeds, so an attacker who controls a configured allow or deny feed can run commands as root.

Both flaws allow remote code execution on the system that is supposed to protect the server. They affect the original ConfigServer releases and any WebPros fork builds that still contain the vulnerable code. Other forks or independently maintained CSF builds may also be affected and need their own review. Upgrade to version 16.30 now.