A critical OS command injection flaw in Softaculous Virtualizor's billing module handler lets unauthenticated remote attackers run arbitrary commands as root, handing them the host and every VPS it manages.
What Is It
CVE-2026-43641 is an OS command injection vulnerability (CWE-78) in the billing module handler of Softaculous Virtualizor. Attackers can bypass authentication through specific parameter combinations, then deserialize a crafted billing_data POST field and inject shell payloads via the uid field. That value is passed unmodified to proc_open() through vexec(), resulting in arbitrary command execution as root.
The CVE was published 2026-09-22 by VulnCheck ([email protected]) and carries a CVSS 3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3 (CRITICAL). The record is newly published, so NVD enrichment is still thin; expect the entry to gain detail as analysis proceeds.
Why It Matters
Exploitation requires no privileges, no user interaction, and no special attack conditions; just network access to the billing endpoint. Confidentiality, integrity, and availability impacts are all rated High. Because the injected command runs as root, a successful attack yields complete control of the Virtualizor host and all VPS instances it manages, making a single compromised panel a pivot into every tenant workload behind it.
There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the source material, and no KEV remediation deadline applies.
What's Vulnerable
- Vendor: Softaculous
- Product: Virtualizor
- Fixed in: 3.2.9 (Patch 9)
- Affected: the builds enumerated as affected in the vendor-supplied version data, all of which precede 3.2.9 (Patch 9)
- Listed as unaffected: 3.0.0
The vendor-supplied version data is an enumeration, not a blanket range: the default status for versions it does not list is "unaffected," and 3.0.0 appears explicitly as unaffected even though it is older than the fixed build. Treat the vendor's enumeration as authoritative rather than assuming every pre-3.2.9 build is in scope, or that every unlisted one is safe. Operators running 3.0.0 specifically should confirm status with Softaculous before concluding they are out of scope, since the vulnerable code path is not documented as version-gated. No CPE entries are present in the NVD record.
Patch Status
Softaculous has shipped fixed builds. Virtualizor 3.2.9 (Patch 9) is the fixed baseline, and version 3.3.0 is also referenced in the advisory material. Operators running any build the vendor lists as affected should update to 3.2.9 (Patch 9) or later immediately; given the unauthenticated, network-reachable nature of the flaw, restricting access to the Virtualizor panel is a reasonable interim measure until patching completes.