by Kastro
Paper/Archive/CVE-2026-43641

CVE-2026-43641

Softaculous Virtualizor — Softaculous Virtualizor OS Command Injection via Billing Module Handler

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.4.874 × 2017.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

Affected

ProductAffectedFixed inSource
Virtualizor< 3.2.9 (Patch 9)3.2.9 (Patch 9)CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitvulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rcepatchvirtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9patchvirtualizor.com/blog/virtualizor-3-3-0writeupvulncheck.com/advisories/softaculous-virtualizor-os-command-injection-via-billing-module-handler