Critical Vulnerability in CSF MESSENGER (CVE-2026-67402) - 03/September/2026

Check: <https://nvd.nist.gov/vuln/detail/CVE-2026-67402>

Check:

A critical vulnerability was found in the MESSENGER service in the ConfigServer Firewall (CSF) software which could allow for unauthorized code execution.
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros (Cpanel team) addressed the vulnerability in version 16.31.

This has a public CVE record listed with further information: CVE-2026-67402

Note: By default, the MESSENGER service is disabled.

Affected Product versions:
Product: csf

Affected Versions: CSF 16.30-1 and older

Patched Versions: 16.31+

Impact:
Exploiting this could allow an attacker to execute code as the Apache user.

Mitigation:

It is highly recommended that you update the installed CSF version as soon as possible.

If this is not possible, you can disable the MESSENGERV3 setting in CSF.

Access the server as the root user via SSH, or the Terminal in WHM.

Edit the CSF configuration file:

nano /etc/csf/csf.conf

Update the MESSENGERV3 option to be disabled:

Save and restart the CSF and LFD services:

Version from Aetherinox was not updated yet. Is recommmended you use mitigation above.

Do it as soon as possible, my self server already was attacked.

Regards,
Netino