CVE-2026-43641: Softaculous Virtualizor RCE Vulnerability

CVE-2026-43641 Overview

CVE-2026-43641 is an OS command injection vulnerability [CWE-78] in Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0. The flaw resides in the billing module handler and allows unauthenticated remote attackers to execute arbitrary commands as root. Attackers bypass authentication through specific parameter combinations, deserialize a crafted billing_data POST field, and inject shell payloads through the uid field. The uid value is passed unmodified to proc_open() via the internal vexec() helper, producing full host compromise and control over every managed VPS instance.

Critical Impact
Unauthenticated attackers gain root execution on the Virtualizor host, granting takeover of the hypervisor and every VPS it manages.

Affected Products

Softaculous Virtualizor versions before 3.2.9 (Patch 9)
Softaculous Virtualizor 3.0.0
Virtualizor-managed VPS instances on affected hosts

Discovery Timeline

2026-09-22 - CVE-2026-43641 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-43641

Vulnerability Analysis

The vulnerability chains three distinct flaws inside the Virtualizor billing module handler. First, specific parameter combinations bypass the authentication layer that normally gates administrative endpoints. Second, the handler accepts a billing_data POST field and deserializes it without validation, exposing an insecure deserialization surface. Third, one of the resulting object properties, the uid field, is forwarded to the vexec() helper, which invokes proc_open() without sanitizing shell metacharacters.

Because the Virtualizor control panel runs as root to manage KVM, OpenVZ, and Xen guests, injected commands execute with the highest privileges on the host. An attacker who reaches the endpoint over the network can read hypervisor secrets, pivot into any hosted VPS, deploy persistence, or destroy tenants. See the VulnCheck advisory and the VulnCheck technical write-up for exploitation mechanics.

Root Cause

The root cause is missing input validation combined with unsafe process execution. The vexec() wrapper concatenates attacker-controlled uid data into a command string handed to proc_open(). No allow-list, escaping, or escapeshellarg() call is applied, so shell metacharacters break out of the intended argument context.

Attack Vector

Exploitation requires only network access to the Virtualizor management interface. The attacker submits a single HTTP POST request that satisfies the authentication-bypass parameter set and includes a serialized PHP payload in billing_data with a shell command embedded in uid. No user interaction or prior credentials are required. Refer to the VulnCheck exploit write-up for the request structure and payload construction.

Detection Methods for CVE-2026-43641

Indicators of Compromise

POST requests to the Virtualizor billing module handler containing a billing_data parameter with serialized PHP objects (prefixes such as O:, a:, or s:).
Requests where the uid field contains shell metacharacters such as ;, |, `, $(, or newline characters.
Unexpected child processes spawned by the Virtualizor PHP worker or web server user with a parent chain leading to proc_open().
New root-owned cron entries, SSH authorized keys, or reverse-shell listeners appearing on the hypervisor host.

Detection Strategies

Inspect web server access logs for POST requests to billing endpoints from unauthenticated sessions and correlate with process creation events on the host.
Monitor for sh, bash, curl, wget, nc, or python processes whose parent is the Virtualizor service account.
Deploy web application firewall (WAF) rules that block serialized PHP object markers inside the billing_data parameter.

Monitoring Recommendations

Forward Virtualizor application logs, web server logs, and Linux auditd process-execution events to a central analytics platform.
Alert on outbound connections from the hypervisor host to unknown internet destinations, which often indicate post-exploitation command-and-control traffic.
Track file integrity on /root, /etc/cron.*, /etc/systemd/system, and Virtualizor PHP source directories to catch persistence attempts.

How to Mitigate CVE-2026-43641

Immediate Actions Required

Upgrade Virtualizor to 3.2.9 Patch 9 or 3.3.0 immediately on every hypervisor node.
Restrict network access to the Virtualizor management interface to trusted administrator IP ranges using firewall rules.
Audit all Virtualizor hosts for signs of prior exploitation, including unexpected root processes, new accounts, and modified web application files.
Rotate credentials, API keys, and SSH keys stored on or accessible from the hypervisor after confirming a clean state.

Patch Information

Softaculous released fixes in Virtualizor 3.2.9 Release Candidate Patch 9 and in the Virtualizor 3.3.0 release. Both versions address the authentication bypass, remove the insecure deserialization, and sanitize the uid field before it reaches proc_open().

Workarounds

Block the Virtualizor billing module handler endpoint at the reverse proxy or WAF until patches are applied.
Deny HTTP requests that contain serialized PHP object markers inside the billing_data POST parameter.
Enforce network segmentation so that only the billing back end and administrator workstations can reach the Virtualizor management port.

bash

# Example iptables restriction limiting Virtualizor admin port to trusted networks
iptables -A INPUT -p tcp --dport 4085 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4085 -j DROP