Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

SolusVM may let attackers replace any file

CVE-2026-68491 · published 24 days ago
Summary

SolusVM does not properly verify symbolic links, so an attacker could cause the system to overwrite arbitrary files. This could let a malicious user alter or install code on your server, potentially compromising the entire environment. Apply the vendor’s latest update or patch and review file permission settings to block unauthorized changes.

What to do
  • Update webpros solusvm to version 1.30.15 or later.
Affected software
VendorProductAffected versions
webpros solusvm < 1.30.15
Original advisory text
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published15 Sep 2026
Updated7 Oct 2026
First seen15 Sep 2026
Sources
CVE-2026-68491 · NVD
CVE-2026-68491 · MITRE
Track software like this
Free during beta