WebPros Users: Update SolusVM 2 Now to Stop CVE-2026-105474 Root Code Execution

WebPros SolusVM 2 contains a critical server-side template injection flaw that allows remote authenticated users to execute arbitrary code with root privileges. This vulnerability, tracked as CVE-2026-105474, poses a severe threat to infrastructure relying on this virtualization management platform. Security teams must prioritize remediation for any systems running versions up to and including 2.0.0-44576.

The risk

The National Vulnerability Database rates CVE-2026-105474 with a CVSS score of 9.4, classifying it as critical. This high severity reflects the potential for an attacker to gain complete control over the affected server. The underlying weakness is categorized under CWE-1336, indicating a server-side template injection issue. Such flaws typically allow attackers to inject malicious commands into templates processed by the application server.

Who is exposed

Any organization using WebPros SolusVM 2 is potentially exposed if they have not updated their software. The vulnerability specifically impacts versions up to 2.0.0-44576. Administrators managing virtualization environments must verify their current version immediately. If the installed version is older than the latest release, the system could be vulnerable to exploitation by any user with remote authentication credentials.

Cost and compliance

The source material does not provide specific details regarding financial costs or regulatory compliance implications associated with this vulnerability. Organizations should consult their own internal risk management frameworks to determine the impact on their specific compliance obligations. Failure to address critical vulnerabilities may affect adherence to security standards that require timely patching of known exploits.

Our take on the response

Security managers should treat this as an urgent operational priority due to the root-level access it grants. Immediate verification of SolusVM versions across all managed infrastructure is essential. Teams must coordinate with system administrators to apply updates as soon as they are available from the vendor to mitigate this critical exposure.

What defenders should look for

Teams usually monitor for unusual template processing errors or unexpected command executions in application logs. Check whether authenticated users are triggering template rendering functions with unusual parameters. Look for signs of privilege escalation attempts or new processes spawned by the web service account. Containment moves often involve isolating affected servers from the network and reviewing recent authentication logs for suspicious activity patterns.

What to do and how to stay safe: SolusVM

• Verify the current version of SolusVM 2 installed on all servers immediately.
• Check if your version is 2.0.0-44576 or earlier and plan for an update.
• Monitor authentication logs for unusual access patterns from known users.
• Isolate any servers showing signs of unauthorized template execution until patched.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-105474?

The CVSS score for CVE-2026-105474 is 9.4, which is classified as critical.

Which versions of SolusVM 2 are affected by this vulnerability?

SolusVM 2 versions up to and including 2.0.0-44576 are affected by this flaw.

What type of vulnerability is CVE-2026-105474?

It is a server-side template injection vulnerability that allows arbitrary code execution.