Multiple vulnerabilities affecting Plesk
Multiple vulnerabilities have been discovered in Plesk, allowing a malicious actor to write arbitrary files with root privileges and elevate their privileges to root.
Description
Technical context and vulnerability details
Plesk is a widely used hosting control panel for web server, domain, database and email administration. This solution is affected by several vulnerabilities labeled as follows: CVE-2026-68488: This vulnerability arises from a Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symbolic link tracking. Exploitation of this vulnerability would allow an authenticated attacker to escalate privileges to root via taking control of ownership of arbitrary files or directories. This vulnerability is classified as critical with a severity score of 9.9 according to CVSS v3.1. CVE-2026-68487: This vulnerability results from a path traversal vulnerability in Plesk Backup Manager. Exploitation of this vulnerability would allow an authenticated attacker to write arbitrary files with root privileges. This vulnerability is classified as critical with a severity score of 9.9 according to CVSS v3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data integrity breach;
- Data privacy breach;
- Arbitrary code execution;
- Privilege escalation;
Affected systems
Products, components and targeted versions
- Plesk 18.0.80 versions earlier than 18.0.80.7;
- Plesk versions 18.0.79 earlier than 18.0.79.11;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update affected systems to versions 18.0.80.7 or 18.0.79.11;
Sources & External Links
Vendor security advisories and documentation
- https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation
- https://nvd.nist.gov/vuln/detail/CVE-2026-68488
- https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal
- https://nvd.nist.gov/vuln/detail/CVE-2026-68487
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.