Quick answers
- Is CVE-2026-43642 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43642 being exploited in the wild.
- How severe is CVE-2026-43642?
- High severity, with a CVSS score of 8.1, published 22 September 2026.
- Which products and versions are affected?
- Softaculous Virtualizor before 3.2.9 Patch 9, also 3.0.0.
- Is there a fix for CVE-2026-43642?
- A patch was published on 2026-09-01: Virtualizor 3.2.9 Patch 9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-43642 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-43642?
- Check whether you run Softaculous Virtualizor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP object injection flaw in the billing module handler triggered by the login action with from_billing_module parameter present. Attackers supply malicious serialized PHP objects via the billing_data POST field, which are deserialized without allowed_classes restrictions, enabling exploitation of POP chains to achieve remote code execution as root. No authentication is required; the attack is triggered over the network.
Affected products
- Softaculous Virtualizor before 3.2.9 Patch 9, also 3.0.0
Timeline
- 2026-09-22: disclosed: CVE-2026-43642 published
- 2026-09-01: patched: Virtualizor 3.2.9 Patch 9 released