Quick answers
- Is CVE-2026-67402 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67402 being exploited in the wild.
- How severe is CVE-2026-67402?
- Informational severity, published 4 September 2026.
- Which products and versions are affected?
- WebPros ConfigServer Security & Firewall before 16.31.
- Is there a fix for CVE-2026-67402?
- A patch was published on 2026-09-03: Version 16.31 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-67402 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-67402?
- Check whether you run WebPros ConfigServer Security & Firewall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an insecure Apache configuration in ConfigServer Security & Firewall's Messenger v3 HTTPS virtual host that maps /usr/bin as a CGI directory, treating executable system binaries as CGI scripts. An unauthenticated remote attacker can request a mapped executable through the web server to achieve arbitrary command execution with Apache user privileges. The vulnerability requires CSF Messenger v3 and its HTTPS mode to be enabled. WebPros released version 16.31 to address this configuration flaw by removing or properly restricting the CGI mapping.
Affected products
- WebPros ConfigServer Security & Firewall before 16.31
Timeline
- 2026-09-04: disclosed
- 2026-09-03: patched: Version 16.31 released