[ CVE-2026-68492 · Published 23 Sep 2026 ]
Vulnerability in WebPros Plesk
CVSS 8.7
EPSS <1%No fix listed yet
[ Description ]Official description
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.