CVE-2026-43642 Softaculous CVE debrief

Who should care

System administrators and security teams responsible for managing and securing Virtualizor installations should assess their exposure and prioritize remediation to prevent potential system compromise and lateral movement. They should review the vulnerability details, assess the impact on their systems, and take immediate action to upgrade or mitigate the vulnerability.

Why it matters

CVE-2026-43642 is a critical vulnerability in Softaculous Virtualizor that allows unauthenticated remote attackers to execute arbitrary code as root. System administrators and security teams should assess their exposure and prioritize remediation to prevent potential system compromise and lateral movement.

• Remote code execution as root, allowing for complete system compromise
• Unauthenticated attacks, enabling exploitation without credentials
• Potential for lateral movement and further exploitation within the network

Technical summary

The vulnerability exists in the billing module handler of Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0. An unauthenticated remote attacker can supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. The attacker can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.

Defensive priority

High

Recommended defensive actions

• Immediately upgrade to Virtualizor 3.2.9 (Patch 9) or later
• Restrict access to the billing module handler
• Implement additional security measures to prevent PHP object injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of restrictions on the allowed_classes parameter in the unserialize() function, which allows attackers to supply arbitrary serialized PHP objects for deserialization.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.