CVE-2026-68492: High severity Plesk Plesk vulnerability
Published Sep 23, 2026
·Updated
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
Affected Software
2 affected components
Plesk Plesk>=18.0.34<18.0.80.8, >=18.0.81<18.0.81.1
Plesk Plesk RESTful API extension>=2.4.2<2.4.7
Event History
Sep 23, 2026
CVE Published
via MITRE·07:52 PM
Data Sourced
via MITRE·07:52 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Affected deployments are Plesk versions from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 when using the Plesk RESTful API extension in versions from 2.4.2 before 2.4.7.
2
What level of access does an attacker need?
An attacker must be remotely authenticated. Successful exploitation can result in arbitrary code execution as root.
3
What versions remediate the issue?
Update Plesk to 18.0.80.8 or later in the 18.0.80 branch, or to 18.0.81.1 or later in the 18.0.81 branch, and update the Plesk RESTful API extension to version 2.4.7 or later.