CVE-2026-68488: Race Condition
Published Sep 10, 2026
·Updated
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
Affected Software
1 affected component
Plesk
Event History
Sep 10, 2026
CVE Published
via MITRE·04:24 PM
Data Sourced
via MITRE·04:24 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attack requires local access with low privileges. No user interaction is required.
2
Can this be exploited remotely over the network?
The listed attack vector is network, but the description specifically describes local privilege escalation through a symlink race. The provided information does not explain the network-reachable path or conditions.
3
What is the potential impact if exploitation succeeds?
An attacker can escalate privileges to root by taking over ownership of arbitrary files or directories. This can result in complete compromise of confidentiality, integrity, and availability.