CVE-2026-43641

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 (Patch 9) Softaculous Virtualizor version 3.0.0

Description An OS command injection exists in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific parameter combinations to execute arbitrary commands as root. This is achieved by deserializing a crafted billing data POST field and injecting shell payloads through the uid field. The uid variable is passed unmodified to the proc open() function via vexec(), potentially granting complete control of the host and all managed VPS instances.

Recommendations Update Softaculous Virtualizor to version 3.2.9 (Patch 9) or newer. Update Softaculous Virtualizor to version 3.3.0 or newer.