Critical severity · published Sep 22, 2026
CVE-2026-43641
Softaculous Virtualizor OS Command Injection via Billing Module Handler
9.8
CVSS
3%
EPSS
No
On KEV
Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Virtualizor · Softaculous
before 3.2.9 (Patch 9) · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43641
technical-description
https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce
release-notes
https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
release-notes
https://www.virtualizor.com/blog/virtualizor-3-3-0/
third-party-advisory
https://www.vulncheck.com/advisories/softaculous-virtualizor-os-command-injection-via-billing-module-handler
More from Virtualizor
8.1
CVE-2026-43642
Softaculous Virtualizor PHP Object Injection via Billing Module Handler
7.5
CVE-2026-43643
Softaculous Virtualizor Authorization Bypass via Billing Module Handler