CVE-2026-43641criticalCWE-78

CVE-2026-43641: critical vulnerability in Softaculous Virtualizor

Softaculous Virtualizor OS Command Injection via Billing Module Handler

Published · Updated

Follow this CVE+ Monitor Virtualizor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 3.0%
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Softaculous · Virtualizor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Softaculous Virtualizor

In the same product, most dangerous first.

CVE-2026-43642CRITICALSoftaculous Virtualizor PHP Object Injection via Billing Module HandlerEPSS 1.0%CVE-2026-43643HIGHSoftaculous Virtualizor Authorization Bypass via Billing Module HandlerEPSS 0.6%