What’s Vulnerable › Vulnerabilities

CVE-2026-43642: Softaculous Virtualizor PHP Object Injection via Billing Module Handler

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-22 · updated 2026-09-26
• Weakness: CWE-502

Description

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POST field to the unserialize() function without allowed_classes restrictions, enabling exploitation of available POP chains to achieve remote code execution as root.

Affected products

• Softaculous Virtualizor: before 3.2.9 (Patch 9) — fixed in 3.2.9 (Patch 9)

How to fix

Upgrade to a fixed version: Softaculous Virtualizor 3.2.9 (Patch 9). Check the vendor advisory for mitigations.

References

• https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/
• https://www.virtualizor.com/blog/virtualizor-3-3-0/
• https://www.vulncheck.com/advisories/softaculous-virtualizor-php-object-injection-via-billing-module-handler
• https://www.vulncheck.com/blog/virtualizor-billing-hook-unauthenticated-root-rce

Get alerted when CVE-2026-43642 or the next vulnerability affects your stack