Critical severity · published Sep 15, 2026
CVE-2026-68491
An insufficient check allowed for the overwrite of arbitrary files via a symlink
9.4
CVSS
0.5%
EPSS
No
On KEV
Description
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
SolusVM · Webpros
before 1.30.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68491
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-68491
docs.solusvm.com
https://docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015
docs.solusvm.com
https://docs.solusvm.com/en/solusvm1/release-notes/stable-branch/v1.30/#13015
support.solusvm.com
https://support.solusvm.com/hc/en-us/articles/43503583489687-CVE-2026-68491-Vulnerability-in-SolusVM-1-allows-Guest-to-Host-privilege-escalation