CVE-2026-67402: Critical severity Apache HTTP Server vulnerability
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebPros ConfigServer Security & Firewall (CSF) Messenger v3to a version that resolves this vulnerability.Fixed in 16.31 - Configuration
In the CSF Messenger v3 HTTPS virtual host Apache configuration, remove/disable the insecure configuration that maps /usr/bin as CGI programs.
Apache (ConfigServer Security & Firewall Messenger v3 HTTPS virtual host) CGI program mapping for /usr/bin = Disable mapping of /usr/bin as CGI programs - Compensating control
Ensure the attacker source IP is blocked at the network/firewall layer so requests from blocked addresses cannot reach the vulnerable Apache/CSF Messenger v3 HTTPS mapping.
Event History
Frequently Asked Questions
Which installations are exposed?
Installations are affected when CSF Messenger v3 is enabled with its HTTPS mode enabled. The issue involves the Messenger v3 HTTPS virtual host mapping /usr/bin as CGI programs.
Does an attacker need to authenticate or have an allowed source address?
No. A remote unauthenticated attacker whose address is blocked can exploit the issue by requesting a mapped executable.
What level of access can successful exploitation provide?
Successful exploitation can run arbitrary commands as the Apache user.
What version addresses the issue?
WebPros addressed the vulnerability in version 16.31.