Loading vulnerability…
XPath Injection to Root Command Execution in Plesk APS Application Catalog
CVE-2026-44962 is a critical XPath injection vulnerability in Plesk for Linux affecting the APS Application Catalog search functionality. The flaw is caused by user-supplied search input being interpolated into XPath queries against XML-backed APS Catalog data without proper sanitization. An authenticated low-privileged user can abuse the vulnerable search feature to inject crafted XPath expressions that reach backend processing paths and ultimately trigger arbitrary operating system command execution on the underlying server. Because the affected backend operations execute with higher privileges than the initiating user, successful exploitation results in local privilege escalation, up to root-level command execution. Affected versions include Plesk Obsidian 18.0.75 before 18.0.75.1 and 18.0.76 before 18.0.76.2; more broadly, installations prior to 18.0.77 are exposed when APS Catalog remains enabled.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privileged user to execute arbitrary operating system commands on the affected Linux server with elevated privileges, potentially reaching root. This can lead to full compromise of the host, including unauthorized access to sensitive configuration and hosted data, modification or destruction of system and application content, disruption of hosted services, and abuse of the server as a pivot point in shared-hosting or multi-tenant environments. The vulnerability has high impact on confidentiality, integrity, and availability and crosses the intended privilege boundary between low-privileged panel users and privileged backend execution contexts.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the APS subsystem or APS Catalog functionality in the Plesk configuration so the vulnerable search path is no longer reachable. Available guidance indicates setting APS to disabled in the panel configuration file and restarting the relevant management components. This is only a temporary risk-reduction measure and should be followed by installation of the vendor patch as soon as possible.
Patch, then assume compromise.
Upgrade Plesk for Linux to a fixed release. The vulnerability is addressed in Plesk Obsidian 18.0.75.1 and 18.0.76.2. Later versions are also not affected, and version 18.0.77 removes APS Catalog entirely. Organizations should apply the vendor security updates on all affected systems, prioritizing internet-exposed and multi-tenant deployments.
No public exploits tracked yet. Mallory keeps watching.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.