CRITICAL 9.3 NVD
CVE-2026-43641
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticate
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
References
- https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
- https://www.virtualizor.com/blog/virtualizor-3-3-0/
- https://www.vulncheck.com/advisories/softaculous-virtualizor-os-command-injection-via-bill
- https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-22 via NVD.
Risk Timeline
CVE Disclosed2026-09-22 · -1 days ago
Remediation Resources
Analysis & PoC
www.virtualizor.com/blog/virtualizor-3-3-0/
vulnfeed aggregates 13417 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.