VulnSocial

CVE-2026-43641Patch

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts

Recommended action window: High priority (within 72h)

NVD description

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

Back to dashboard
2.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Exploit tooling references are present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-09-27: 1Exploit Tool / Code · 2026-09-27: 1Patch / Workaround · 2026-09-22: 1Technical Details · 2026-09-22: 1Technical Details · 2026-09-27: 109-2209-27
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-09-221
Patch1
2026-09-271
Disclosure1
Full discourse2 posts
  • ʞʞıdɐɔoɥƆ@Chocapikk_
    Disclosure

    On Virtualizor, the way past the login is to... send act=login 😄 That value skips the guard into a billing hook that pastes your uid field straight into a root shell command. The password to bypass logging in was 'login' all along. CVE-2026-43641 (9.8) https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce https://t.co/6g46aAI3Hm

    Post summary

    The tweet discloses CVE-2026-43641 in Virtualizor, detailing an unauthenticated root RCE mechanism (CVSS 9.8) via a billing hook, but mentions no patch or active exploitation.

    00033364
    4.1K followersView on X
  • Anthony Bahn@HoustonIntrove1
    Patch

    Virtualizor just turned a billing login skip into root. CVE-2026-43641. No password if 4084/4085 face the internet. Builds through 3.2.9 patch 8 are done. Get to patch 9 or 3.3.0 tonight. https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce

    Post summary

    The text reports CVE-2026-43641 in Virtualizor, detailing an unauthenticated root access bypass via the billing login, and explicitly urges upgrading to patch 9 or version 3.3.0 as remediation. No evidence of active exploitation, PoC code, or exploit tools is present in the text.

    0000039
    38 followersView on X

Explore more

Back to dashboard