Critical Plesk APS flaw lets authenticated users execute server commands

Plesk disclosed and patched CVE-2026-44962, a critical privilege-escalation flaw in Plesk on Linux that allows a low-privileged authenticated user to execute arbitrary operating system commands on affected servers. The bug stems from an XPath injection issue in the APS Application Catalog search function, where unsanitized input is inserted into XPath queries, enabling remote exploitation without user interaction. The vulnerability carries a CVSS 10.0 rating and can lead to administrative access and full compromise of server resources, with particular risk for shared hosting and other multi-tenant deployments.

Plesk released fixes in versions 18.0.76.2 and 18.0.75.1, and advised administrators to update immediately. For systems that cannot yet be patched, the company said the APS subsystem should be disabled through the panel.ini configuration file and management components restarted. The flaw was responsibly disclosed by Georgii Shutiaev, and reports said there was no public evidence of active exploitation at the time of publication, though defenders were urged to review access controls and monitor for suspicious command execution.