CVE-2026-43641CWE-78command-injection

CVE-2026-43641

Critical · published September 22, 2026

CVSS v3.1
9.8
EPSS
3%
Percentile
87.4
In the wild
Unconfirmed
What it is

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.03026 · 87.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-22T22:17Z
References (4)
https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/ · [email protected]https://www.virtualizor.com/blog/virtualizor-3-3-0/ · [email protected]https://www.vulncheck.com/advisories/softaculous-virtualizor-os-command-injection-via-billing-module-handler · [email protected]https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce · [email protected]
EPSS history
Timeline
  • 24 SEP 03:23Z
    EPSS moved — → 3%
    epss
  • 22 SEP 17:51Z
    Softaculous Virtualizor OS Command Injection via Billing Module Handler
    cvelistv5