Security readout for executives and security teams
Plain-English summary
A dangerous CSF web-server configuration can let an unauthenticated internet attacker execute commands on affected servers. Exposure requires CSF Messenger v3 with HTTPS enabled and an attacker address blocked by CSF. Successful exploitation runs with the Apache account’s permissions and could compromise data or disrupt services. WebPros addressed the issue in version 16.31.
Executive priority
Treat this as an urgent remediation item for exposed servers. Immediately identify Messenger v3 HTTPS deployments and upgrade them to version 16.31 or later. The critical rating reflects unauthenticated command execution with high confidentiality, integrity, and availability impact. Systems without the required Messenger configuration are not described as exposed by the supplied sources.
Technical view
The Messenger v3 HTTPS virtual host maps /usr/bin as CGI programs. A remote, unauthenticated attacker from a blocked address can request a mapped executable, causing arbitrary command execution as the Apache user. The issue is classified as CWE-552 and has CVSS 4.0 score 9.2. The supplied affected-version metadata is ambiguous, so configuration-based validation is essential.
Likely exposure
Likely exposure is limited to ConfigServer Security & Firewall installations running Messenger v3 with HTTPS mode enabled. Internet-reachable Messenger endpoints increase concern. The supplied record mentions version 14.02 but marks unspecified versions unaffected, without clearly defining the complete vulnerable range. Do not rely solely on version matching; verify the active Apache and Messenger configuration.
Exploitation context
The attack requires the source address to be blocked, represented by CVSS as an attack requirement. No credentials or user interaction are required. The bundle does not establish active exploitation, and the CVE is not identified as being in KEV. Absence from KEV is not proof that exploitation has never occurred.
Researcher notes
Focus validation on the Messenger v3 HTTPS Apache virtual host and whether /usr/bin is exposed through CGI handling. Execution is limited initially to the Apache user, but resulting impact depends on that account’s permissions and local controls. The bundle provides no evidence of public exploitation or a complete vulnerable-version range; avoid asserting either.
Mitigation direction
- Upgrade ConfigServer Security & Firewall to version 16.31 or later.
- Prioritize internet-facing systems with Messenger v3 HTTPS enabled.
- If upgrading is delayed, consult WebPros guidance before changing or disabling Messenger HTTPS.
- Restrict network access to the Messenger HTTPS service where operationally feasible.
Validation and detection
- Inventory ConfigServer Security & Firewall versions across managed servers.
- Identify installations with Messenger v3 and HTTPS mode enabled.
- Inspect the Messenger HTTPS virtual host for CGI mapping of /usr/bin.
- Confirm upgraded systems report version 16.31 or later.
- Review web-server logs for suspicious requests targeting mapped system executables.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-67402 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N——hackeroneVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.cpanel.net/hc/en-us/articles/43171958716439-Security-CSF-Security-Release-September-3rd-2026CVE reference, hackerone
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.