Virtualizor Login Guard Lets Three Bugs Reach Root
VulnCheck found an unauthenticated remote root code execution path in Softaculous Virtualizor 3.2.9 patch 7, with three separate flaws hidden behind one pre-auth guard. The same issue covers CVE-2026-43641, CVE-2026-43642, and CVE-2026-43643.
The panel’s login check is mis-scoped: the value meant for the login page, `act=login`, is the one that falls through into code meant to run before authentication. From there, attacker-controlled input can reach an OS command injection path, a PHP object injection path, or a cross-tenant balance write, and because the admin panel runs web requests with host-level privileges, the result is root on the node, not just a compromised web session.
For operators running Virtualizor or similar web-based VPS and hypervisor panels, the exposure sits in the control plane itself. A bug that looks like a login-handler mistake can still become full host compromise and reach guest or tenant data if the panel executes administrative work as root.
VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.