Critical Server-Side Template Injection Flaw Found in SolusVM 2 Allows Root Code Execution

WebPros SolusVM 2 contains a critical security vulnerability that allows remote authenticated users to execute arbitrary code with root privileges on affected systems. The National Vulnerability Database records the flaw as CVE-2026-105474, assigning it a CVSS score of 9.4, which classifies the issue as Critical severity.

The vulnerability stems from a server-side template injection weakness, identified under CWE-1336. This type of flaw occurs when an application includes untrusted data in a template engine without proper sanitization. According to the NVD record, the issue affects SolusVM 2 up to version 2.0.0-44576. Attackers who have obtained valid authentication credentials can leverage this injection to run commands as the root user.

Technical Context and Severity

The CVSS score of 9.4 indicates a high potential for impact, primarily due to the privilege escalation aspect of the exploit. Root access grants an attacker complete control over the virtualization host, potentially compromising all virtual machines running on that server. The National Vulnerability Database categorizes the weakness as CWE-1336, which relates to the inclusion of untrusted data in a template.

Server-side template injection is particularly dangerous because it often bypasses traditional input validation checks designed for standard injection attacks. The authenticated nature of the exploit means that an attacker must first compromise a user account or intercept valid session tokens. However, once access is gained, the ability to execute code as root removes most system-level restrictions.

Affected Versions and Scope

The vulnerability specifically impacts WebPros SolusVM 2 installations running versions prior to 2.0.0-44576. Any deployment using version 2.0.0-44576 or earlier is considered affected by this security risk. Organizations relying on SolusVM 2 for virtual server management should verify their current version immediately. The NVD record does not specify a release date for a patched version, leaving administrators to assess their exposure based on current software builds.

Because SolusVM is a virtualization management platform, the compromise of the host system can have cascading effects on the entire infrastructure. The authenticated requirement limits the initial attack surface to users with login access, but the consequence of successful exploitation is total system compromise.

What should you do?

Administrators should audit their SolusVM 2 installations to determine if they are running a vulnerable version. Since no patch has been confirmed in the source material, immediate remediation options are limited to isolating affected systems or restricting access. Monitoring for unusual root-level activity is essential while awaiting vendor updates.