← Back to the live CVE advisory feed

CVE-2026-43641: Product identification pending

Severity

9.3 (CRITICAL)

Affected versions

Before 3.2.9

Fixed version

3.2.9

Patch status

Patched

Published

2026-09-22T18:17:14.357

Modified

2026-09-22T20:43:58.793

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

View the official NVD record for CVE-2026-43641

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.