Key points
- CVE-2026-105474 is rated CVSS 9.4, the highest severity level.
- The flaw exists in SolusVM 2 versions up to and including 2.0.0-44576.
- Remote authenticated users can execute arbitrary code with root privileges.
WebPros SolusVM 2 contains a critical security flaw that affects all versions up to 2.0.0-44576. The vulnerability, identified as CVE-2026-105474, allows remote users who have already logged in to execute arbitrary code. This execution happens with root privileges, meaning an attacker gains full control over the affected system.
In plain English
Server-side template injection is a type of software error where user input is processed incorrectly by the server. In this case, an attacker can insert malicious code into the template engine. When the server processes this template, it runs the attacker's code instead of just displaying data. Because the code runs as root, the attacker can install software, change settings, or steal data from the entire server.
The background
The National Vulnerability Database lists this issue with a CVSS score of 9.4. This places it in the critical category. The weakness is classified under CWE-1336, which relates to server-side template injection. The flaw requires the attacker to have an authenticated session, meaning they must have valid login credentials for the SolusVM interface. Without valid credentials, they cannot exploit this specific vulnerability.
What changes now
Administrators using affected versions must treat their systems as compromised if unauthorized access is suspected. Since the flaw allows root-level code execution, the impact is severe. Organizations should monitor their SolusVM instances closely for any unusual activity or unauthorized changes. The source material does not mention a specific fix or update timeline.
Who needs to act first
Teams should prioritize systems exposed to the internet or those handling sensitive customer data. Check whether your current SolusVM version falls within the vulnerable range immediately. If you cannot update yet, consider restricting access to the administrative interface using strict IP whitelisting. Back up all configuration files and data before making any changes. Test any future updates in a isolated environment first to ensure they do not break existing services. Monitor logs for signs of unauthorized template manipulation or unexpected command execution. Limit the number of users with administrative access to reduce the risk of credential theft.
Background: Server-side template injection
Server-side template injection occurs when user input is treated as executable code within a server-side template engine. Developers often mistake template variables for safe strings. This mistake allows attackers to read files, execute commands, and take over the server. Fix it by separating data from logic and using strict output encoding.
Read the full guide: Server-Side Template Injection Mistakes That Expose Your Data
What to do and how to stay safe: SolusVM
- Verify your SolusVM version against the affected list up to 2.0.0-44576.
- Restrict administrative access to trusted IP addresses if possible.
- Monitor system logs for unusual command executions or template changes.
- Prepare to apply a vendor update as soon as it becomes available.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of SolusVM are vulnerable?
All versions of SolusVM 2 up to and including version 2.0.0-44576 are affected by CVE-2026-105474.
Is there a patch available yet?
The source material does not mention a confirmed fix or update for this vulnerability.
What is the severity of this flaw?
The flaw is rated CVSS 9.4, which is classified as critical severity.
