Vulnerabilities & Exploits · Web App Attack

Virtualizor Login Guard Lets Three Bugs Reach Root

VulnCheck found an unauthenticated remote root code execution path in Softaculous Virtualizor 3.2.9 patch 7, with three separate flaws hidden behind one pre-auth guard. The same issue covers CVE-2026-43641, CVE-2026-43642, and CVE-2026-43643.

The panel’s login check is mis-scoped: the value meant for the login page, `act=login`, is the one that falls through into code meant to run before authentication. From there, attacker-controlled input can reach an OS command injection path, a PHP object injection path, or a cross-tenant balance write, and because the admin panel runs web requests with host-level privileges, the result is root on the node, not just a compromised web session.

For operators running Virtualizor or similar web-based VPS and hypervisor panels, the exposure sits in the control plane itself. A bug that looks like a login-handler mistake can still become full host compromise and reach guest or tenant data if the panel executes administrative work as root.

1 source · 21h ago

Timeline

• Sep 22 Reported by VulnCheck

Sources

• Sep 22 VulnCheck

  Virtualizor: The Login Parameter That Skips the Login | Blog | VulnCheck

  VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.

  original

Part of the PlainSec briefing for 2026-09-22

Every edition of this story: Virtualizor Login Guard Lets Three Bugs Reach Root

More from today

• Check Point Management Plane Under Active Exploit
• F5 BIG-IP APM Zero-Day Is Being Exploited
• MikroTik RouterOS Chain Enabled Unauthenticated Takeover