ConfigServer CSF CVE-2026-65639

Exploitation requires that the target has configured CSF to consume an external allow/deny rule feed and that the attacker controls or can tamper with the content of that feed - this is the AT:P attack requirement in the CVSS 4.0 vector. No authentication to CSF or the host is needed (PR:N) and no local access or victim user interaction is required (UI:N); the limiting factor is entirely the presence of an attacker-influenceable feed. Installations that use only locally defined static allow/deny rules, with no external feed, are not exploitable via this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:H) scores 9.5 and reflects unauthenticated network reach with full root-level confidentiality, integrity and availability impact including subsequent-system compromise. The one meaningful limiter is AT:P (attack requirement present): exploitation is not against a raw default install but depends on CSF being configured to consume an allow/deny feed that the attacker can influence - so the realistic attacker is one who controls or can tamper with (e.g. via MITM or a compromised feed source) a URL an administrator has trusted. No EPSS score, KEV entry, or POC is present in the provided data, so despite the critical score there is no evidence of active or automated exploitation yet; treat as high-priority patching for hosts that pull external CSF feeds, and lower-urgency for installs that use only local static rules.

An administrator configures CSF to ingest an allow/deny blocklist feed from a URL. An attacker who controls that feed (or intercepts its delivery) embeds shell metacharacters in a rule entry; when CSF's advanced-rule parser processes the feed, the injected command executes as root, giving the attacker full server takeover. No public exploit code is identified at time of analysis.