CVE-2026-43641

Summary

This vulnerability allows unauthenticated attackers to execute arbitrary commands as root by exploiting a flaw in the billing module handler, leading to complete control of the host and managed VPS instances.

Exploitability

Exploitation is relatively straightforward with specific parameter combinations, requiring unauthenticated access and deserialization of a crafted billing_data POST field.

Blast radius

If exploited, the attack can result in complete control over the host system and all managed VPS instances, leading to significant data loss and potential system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Softaculous Virtualizor 3.2.9 Patch 9 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.