CSF security update: patch cpanel-csf 16.30-1 and older

cPanel has scheduled a ConfigServer Security & Firewall (CSF) security release for 3 September 2026 at 10:00 AM US Central (15:00 UTC). It fixes multiple vulnerabilities in CSF, including issues rated up to Critical severity.

Only servers with CSF installed are affected. If you never installed it — or you replaced it with the Plesk firewall extension or a cloud provider's security groups — there is nothing to do. This is the second CSF security release since cPanel took over the codebase from Way to the Web, and the same package channel applies.

Affected versions

Servers running cpanel-csf 16.30-1 or older are expected to be affected. That includes the build shipped by the August 2026 release, so patching last month does not cover you this time.

cPanel identified all of these issues internally through its own security review and is not aware of any exploitation in the wild. Exact patched build numbers and the technical write-up land with the public advisory at release time.

Check what you are running

Run both as root — the package version and the running daemon can disagree if CSF was updated but not restarted:

rpm -q cpanel-csf
csf -v

Across a fleet, the fastest sweep is a loop over your inventory:

for h in $(cat servers.txt); do
  printf '%s ' "$h"
  ssh -n "root@$h" 'rpm -q cpanel-csf 2>/dev/null || echo not-installed'
done

Anything reporting 16.30-1 or lower goes on the patch list.

Apply the update

The fix ships through CSF's automatic update channel. Servers with AUTO_UPDATES enabled in /etc/csf/csf.conf pick it up on their own, but the window is up to 24 hours — for a Critical-rated flaw, force it:

dnf clean metadata
/scripts/update-packages

Then confirm the new version and reload:

rpm -q cpanel-csf
csf -r

If /scripts/update-packages fails, the cause is usually a broken repo or an rpm.versions pin rather than CSF itself — the same failure modes covered in fixing cPanel update failures.

What not to do

Stopping CSF is not a mitigation. csf -x flushes the rules and leaves the box with no packet filter at all, which is a strictly worse position than running an unpatched firewall behind an update you can install in two minutes. Leave it running and patch.

Nor is a second security layer a substitute. Imunify360 and CSF coexist at different points in the stack, and cPHulk watches a different log stream than LFD — neither one patches CSF's own code.

After patching

Watch for cPanel's follow-up advisory with the confirmed fixed build and the technical detail. If your server is on an end-of-life cPanel branch, the CSF package will not reach it; upgrade to a supported branch first.

Which CSF versions are affected by the September 2026 security update?+

Servers running cpanel-csf 16.30-1 or older. Servers without CSF installed are not affected.

How do I check my CSF version?+

Run rpm -q cpanel-csf for the installed package and csf -v for the running daemon. Both should report the same version after a restart.

How do I update CSF manually on cPanel?+

Run dnf clean metadata followed by /scripts/update-packages as root, then csf -r to reload. Do not wait for the automatic channel on a Critical-rated fix.

Is CSF being exploited in the wild?+

cPanel found these issues internally through its own security review and stated it is not aware of any exploitation at the time of the advisory.

Do I need to disable CSF until I can patch?+

No. Disabling CSF removes your packet filter entirely, which is worse than running an unpatched one. Patch instead — it takes minutes.

Next steps

A current cPanel license keeps a server on a supported branch, which is what entitles it to security packages like this one.