SolusVM 2 CVE-2026-105474 (CVSS 4.0 9.4): authenticated server-side template injection lets a panel user run code as root on the management node; patch build 2.0.0-44739

SolusVM published advisory CVE-2026-105474 (updated 13 October 2026) for a server-side template injection in SolusVM 2, the virtual-server control panel used by many hosting providers. An authenticated user can execute arbitrary code on the server with elevated privileges, which SolusVM says can lead to full compromise of the management node and affect other customers hosted on the same node. Rapid7 records CVSS 4.0 base score 9.4 (Critical) for the issue and describes remote authenticated users reaching root. Affected: all SolusVM 2 builds through 2.0.0-44576. Patched version listed by SolusVM: 2.0.0-44739. The advisory tells operators to update to 2.0.0-44739 or later once that build is available. Credited to Georgii Shutiaev. No in-the-wild exploitation is stated in the vendor note or the Rapid7 entry this pass. Primary: SolusVM support advisory; CVE record published around 15 Oct 2026 per Rapid7.

Product

SolusVM 2 (virtual-server / hosting control panel)

Versions

Affected: all SolusVM 2 versions up to 2.0.0-44576. Patched: 2.0.0-44739 (per SolusVM advisory).

CVSS

9.4 (CVSS 4.0 Critical — Rapid7)

Exploited in Australia?

unknown

Patch to

Upgrade SolusVM 2 management nodes to 2.0.0-44739 or later when the build is available. Until then: restrict who can log into the panel and API, review unused low-privilege accounts, and monitor for unexpected root-level activity on the management host. Patching guest VMs alone does not fix the management node.

Primary: SolusVM — CVE-2026-105474 Server-Side Template Injection in SolusVM 2 (updated 13 Oct 2026) · Vendor: SolusVM support advisory CVE-2026-105474 · CVE: CVE-2026-105474 · Rapid7 — CVE-2026-105474 (CVSS 4.0 9.4; published 15 Oct 2026)

vulnerabilities cloud