CVE-2026-68487 – WebPros Plesk
“When a customer account can write files as root, your hosting panel stops being a control plane and becomes an open door.”
This Plesk update fixes three flaws that each give an attacker root-level control of the hosting server. CVE-2026-68487 has a CVSS score of 9.9, Critical severity. It is a path traversal flaw in the Backup Manager that lets an authenticated customer write any file as root. CVE-2026-68488 has a CVSS score of 9.9, Critical severity. It is a race condition that follows insecure symlinks, letting a local user take ownership of any file or directory and escalate to root.
CVE-2026-68492 has a CVSS score of 8.7, High severity. It is an untrusted search path flaw that lets remote authenticated users run arbitrary code as root through the Plesk RESTful API extension. It affects Plesk 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1, with RESTful API extension 2.4.2 before 2.4.7. On a shared hosting server, one compromised customer account can become full server takeover, which puts every hosted site and its data at risk. Apply the Plesk update on the same day.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-36