Critical severity · published Oct 15, 2026
CVE-2026-105474
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root
9.4
CVSS
0.5%
EPSS
No
On KEV
Description
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S2
SolusVM 2 · WebPros
through 2.0.0-44576 · source: vendor