PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105474 WebPros CVE debrief

CVE-2026-105474 debrief based on CVE Program and NVD records. A server-side template injection vulnerability exists in SolusVM 2 up to version 2.0.0-44576, allowing remote authenticated users to execute arbitrary code as root. The CVSS score is 9.4, indicating critical severity. This vulnerability has significant implications for SolusVM 2 administrators and security teams, who should assess exposure, apply patches, and monitor for suspicious activity. The CVE Program and NVD records confirm the vulnerability, and immediate action is necessary to prevent potential system compromise and lateral movement.

Vendor
WebPros
Product
SolusVM 2
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-15
Advisory published
2026-10-15
Advisory updated
2026-10-15

Who should care

SolusVM 2 administrators and users, security teams responsible for virtualization infrastructure, and IT personnel managing authentication and authorization

Why it matters

CVE-2026-105474 is a critical server-side template injection vulnerability in SolusVM 2 that allows authenticated users to execute arbitrary code as root. SolusVM 2 administrators and security teams should assess exposure, apply patches, and monitor for suspicious activity.

  • Potential for authenticated users to execute arbitrary code as root, leading to complete system compromise
  • High risk of lateral movement and privilege escalation
  • Possible disruption of virtualization services
  • Need for immediate patching and verification of SolusVM 2 installations

Technical summary

A server-side template injection vulnerability exists in SolusVM 2 up to version 2.0.0-44576. This vulnerability allows remote authenticated users to execute arbitrary code as root. The vulnerability has a CVSS score of 9.4, indicating critical severity.

Defensive priority

High priority for SolusVM 2 administrators to assess exposure and apply patches.

Recommended defensive actions

  • Assess exposure of SolusVM 2 installations
  • Verify version and apply patches if necessary
  • Monitor for suspicious activity
  • Implement compensating controls for authentication and template injection

Evidence notes

The CVE Program and NVD records confirm the vulnerability in SolusVM 2. The CVE description states that remote authenticated users can execute arbitrary code as root due to a server-side template injection vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105474 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105474

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105474 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105474

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-105474

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/105xxx/CVE-2026-105474.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.