SolusVM 2 EUVD-2026-102142

Exploitation requires valid authenticated access to a SolusVM 2 management panel (CVSS PR:L), so the attacker must already hold low-privileged credentials such as a client, reseller, or sub-account on the hosting provider's instance - this is the primary limiting factor and excludes fully anonymous attackers. Given it, the flaw is a server-side template injection reachable over the network (AV:N) with low attack complexity and no user interaction (AC:L/UI:N), affecting SolusVM 2 up to and including version 2.0.0-44576; successful injection yields code execution as root. The exact panel field or feature that renders attacker input through the template engine is not specified in the available data and should be confirmed against the vendor advisory.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only low-level authentication, with high impact to confidentiality, integrity, and availability on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with the description's claim of arbitrary code execution as root via server-side template injection (CWE-1336). The description's 'remote authenticated users' aligns cleanly with PR:L, so there is no network-vs-local conflict here. The main mitigating signal is PR:L: an attacker needs valid panel credentials, which bounds exposure to users who can already authenticate (e.g., tenants/resellers/clients of a hosting panel) rather than fully anonymous internet attackers. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so exploitation probability cannot be quantified and there is no evidence of active exploitation - the signals are thus a vendor-confirmed severe code-execution flaw with authentication as the primary barrier, but no current indication of in-the-wild use.

An attacker with low-privileged credentials to a SolusVM 2 instance (for example a reseller or client account on a hosting provider's panel) submits input into a field that is unsafely rendered by the server-side template engine, injecting template syntax that breaks out into code execution. Because the resulting code runs as root, the attacker gains full control of the host managing the virtualization environment. No public exploit code was identified at time of analysis.