CVE-2026-43641
Received Received - Intake

OS Command Injection in Softaculous Virtualizor

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-43641
EUVD
EUVD-2026-84620

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
softaculous virtualizor to 3.2.9 (exc)
softaculous virtualizor to 3.2.9|end_including=3.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-43641 is an OS command injection vulnerability in Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0. It allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through crafted billing_data POST fields. The uid field is manipulated to inject shell payloads, which are passed unmodified to proc_open() via vexec(), granting full control of the host and all managed VPS instances.

Detection Guidance

To detect this vulnerability, check if your Virtualizor version is below 3.2.9 (Patch 9) or 3.0.0. Inspect network traffic for POST requests to billing-related endpoints with crafted billing_data fields containing uid parameters. Look for unexpected shell commands executed as root via proc_open(). Use the Security Center in Virtualizor 3.3.0+ to scan for suspicious processes or vulnerabilities.

Impact Analysis

This vulnerability allows attackers to gain root access to the server hosting Virtualizor, enabling complete control over all managed VPS instances. Attackers could steal data, install malware, disrupt services, or use the compromised system as a launchpad for further attacks. Unpatched systems are at severe risk of total compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized root access enabling data breaches, loss of confidentiality, and potential exposure of sensitive user data. Organizations using unpatched Virtualizor versions may face regulatory penalties, legal liabilities, and reputational damage.

Mitigation Strategies

Immediately upgrade Virtualizor to version 3.2.9 (Patch 9) or 3.3.0 or later. Ensure all authentication checks are enforced and input validation is applied to billing_data and uid fields. Review and revoke any unauthorized access or suspicious processes. Monitor for signs of exploitation such as unexpected root commands or unauthorized user balance changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart