Softaculous Virtualizor — CVE-2026-43641 (Critical)

Date Sep 22, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Softaculous · Virtualizor

CVE CVE-2026-43641

Critical vendor advisory CVE-2026-43641

Summary

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Softaculous Virtualizor. Patch or mitigate promptly.

Operator check

Review CVE-2026-43641 in your asset inventory. Apply patches per vendor guidance and verify Virtualizor is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-43641 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed