Loading story…
Plesk disclosed CVE-2026-68488, a privilege-escalation flaw in Backup Manager for Plesk Obsidian on Linux. An authenticated low-privileged Plesk customer with FTP access can exploit a symlink race during subscription-content restore operations to change ownership of files outside their assigned subscription; because restores run with elevated privileges, exploitation can lead to root-level compromise of the server.
The vulnerability particularly endangers shared-hosting, managed-server, and other multi-tenant deployments. Plesk for Windows is unaffected; administrators should upgrade affected Linux installations to 18.0.80.7 or later or 18.0.79.11 or later, then investigate anomalous restore activity, symlinks in subscription directories, unexpected ownership changes, privileged filesystem modifications, and authentication logs.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Plesk released fixes for CVE-2026-68488, a symlink race condition in Backup Manager restore operations that could let an authenticated Plesk customer with FTP access alter ownership outside their subscription and potentially gain root access on affected Linux servers. The fixes are included in Plesk Obsidian 18.0.80.7 and later and 18.0.79.11 and later; Plesk for Windows is unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, tracked as CVE-2025-66430, has been identified in Plesk for Linux, specifically affecting the Password-Protected Directories feature. This flaw allows authenticated Plesk users to inject arbitrary data into Apache configuration files, leading to local privilege escalation and enabling attackers to execute commands with root-level privileges. The vulnerability poses a severe risk of complete server compromise, data theft, malware installation, and lateral movement within affected environments. Plesk versions 18.0.70 through 18.0.74, including Plesk Onyx installations, are impacted, and security updates have been released to address the issue. Administrators are strongly advised to apply the latest micro-updates (18.0.73.5 and 18.0.74.2) immediately to mitigate the risk. The vulnerability is the result of improper access control and insufficient input validation within the Password-Protected Directories feature. Exploitation requires access to a Plesk user account, but once achieved, attackers can escalate privileges to root, representing a significant threat to organizations relying on Plesk for server management. The issue is classified as critical, with a CVSS score of 9.1, and is remotely exploitable. Official Plesk documentation provides detailed guidance for patching affected systems, and prompt remediation is essential to prevent exploitation in the wild.
Jun 29, 2026
WebPros Plesk before version **18.0.80.1** is affected by **CVE-2026-64637**, an improper privilege management flaw in the **XML-RPC API** that allows an authenticated reseller to obtain an administrative session for the **root** user account. The vulnerability is classified as **CWE-269** and carries a high-severity **CVSS v3** vector of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, indicating low attack complexity and potentially severe impact on confidentiality, integrity, and availability. A related advisory from **CERT-PY** flagged the issue in Plesk products, reinforcing the risk to organizations that use the hosting control panel in multi-tenant or reseller environments. Available records indicate the flaw is not currently assessed as exploited in the wild and is not considered automatable, but its ability to let a lower-privileged authenticated user escalate directly to root-level administration makes prompt upgrading to **18.0.80.1** or later a priority.
Aug 8, 2026
Plesk disclosed and patched **CVE-2026-44962**, a critical privilege-escalation flaw in **Plesk on Linux** that allows a low-privileged authenticated user to execute arbitrary operating system commands on affected servers. The bug stems from an **XPath injection** issue in the **APS Application Catalog** search function, where unsanitized input is inserted into XPath queries, enabling remote exploitation without user interaction. The vulnerability carries a **CVSS 10.0** rating and can lead to administrative access and full compromise of server resources, with particular risk for shared hosting and other multi-tenant deployments. Plesk released fixes in versions **18.0.76.2** and **18.0.75.1**, and advised administrators to update immediately. For systems that cannot yet be patched, the company said the **APS subsystem** should be disabled through the `panel.ini` configuration file and management components restarted. The flaw was responsibly disclosed by **Georgii Shutiaev**, and reports said there was no public evidence of active exploitation at the time of publication, though defenders were urged to review access controls and monitor for suspicious command execution.
Jun 29, 2026