A critical security flaw has been uncovered in WebPros Plesk, one of the world’s most widely deployed web hosting control panels, allowing authenticated low-privileged attackers to execute arbitrary OS commands and seize complete server control.
Tracked as CVE-2026-44962, the vulnerability has been assigned a CVSS 3.1 score of 10.0, the highest possible severity rating, underscoring the grave risk it poses to Linux hosting environments globally.
The vulnerability lies in Plesk’s APS Application Catalog search functionality, where user-supplied input is interpolated directly into XPath queries without proper sanitization.
Classified under CWE-643 (Improper Neutralization of Data within XPath Expressions), this is an injection-class weakness analogous to SQL injection but targeting XML-based data stores.
Critical Plesk Vulnerability
By crafting malicious search input, an attacker can manipulate the structure of the XPath query itself, bypassing application logic and triggering unauthorized system-level operations.
The flaw was formally published on May 29, 2026, indicating it was submitted through a coordinated bug bounty disclosure program.
The attack is fully network-accessible, requires no user interaction, carries low attack complexity, and demands only a low-privilege authenticated session, meaning any standard hosting account holder qualifies, Plesk said.
Successful exploitation enables arbitrary OS command execution and full local privilege escalation, with confidentiality, integrity, and availability all rated High. This vulnerability also continues a troubling pattern for Plesk on Linux.
A prior critical flaw, CVE-2025-66430, disclosed just months earlier, exposed a similar privilege-escalation path via the Password-Protected Directories feature, allowing attackers to inject data into Apache configuration files and gain root access.
Affected Platform and Patch
The vulnerability affects Plesk for Linux across installations running the APS Catalog feature. The Plesk team responded quickly fixed versions were shipped on February 24–25, 2026 :
| Fixed Version | Release Date |
|---|---|
| Plesk 18.0.76.2 | February 25, 2026 |
| Plesk 18.0.75.1 | February 24, 2026 |
Administrators should apply updates immediately using Plesk’s built-in updater. Instructions are available via the official How to Install Plesk Updates guide.
For environments where immediate patching is not feasible, Plesk recommends temporarily turning off the APS Catalog feature as a mitigation measure. This is done by adding the following configuration block to /usr/local/psa/admin/conf/panel.ini and restarting Plesk services:
[aps]
enabled = offThis turns off the vulnerable search module entirely, neutralizing the active attack surface until a full upgrade can be applied.
The vulnerability was responsibly disclosed by security researcher Georgii Shutiaev, who coordinated with the Plesk team to ensure a patch was available before public notification, a commendable example of responsible vulnerability disclosure.
Hosting providers, managed service providers, and enterprise teams running Plesk on Linux should treat CVE-2026-44962 as an immediate critical priority.
A CVSS 10.0 flaw that is network-accessible, low-complexity, and requires no user interaction represents one of the most dangerous classes of vulnerabilities in production server infrastructure.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
