CVE-2026-105474

CriticalCVSS 9.4

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

38th percentile - higher than 38% of all known CVEs

Summary

A server-side template injection (SSTI) vulnerability exists in SolusVM 2 up to version 2.0.0-44576, allowing remote authenticated users to execute arbitrary code as root.

Risk Assessment

An authenticated remote user can execute arbitrary code with root privileges, leading to full compromise of the virtualization management system.

Recommendation

Upgrade SolusVM 2 to a version later than 2.0.0-44576.

Other vulnerabilities in SolusVM 2

CVE-2022-42175High
Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.

Original NVD description (English source)

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS