Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

SolusVM 2 lets logged-in users run code as root

CVE-2026-105474 · published today
Summary

The SolusVM 2 management panel (up to version 2.0.0‑44576) can be tricked by an authenticated user into running any command with full system privileges. This could let an attacker take control of the server and access all data. Apply any available security updates or patches immediately and restrict remote access to trusted administrators only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webpros solusvm 2 <= 2.0.0-44576
Original advisory text
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
References
Severity
9.4 Critical
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-105474 · NVD
CVE-2026-105474 · MITRE
Track software like this
Free during beta