Plesk CVE-2026-44962

Exploitation requires an authenticated session on the Plesk panel at any privilege tier (PR:L), network reachability to the panel's web interface, and that the target deployment has the APS Application Catalog component enabled and exposes its search functionality to the attacker's account role. No user interaction by an administrator is needed (UI:N), and attack complexity is low (AC:L), so no race conditions or unusual environmental conditions limit reliability. The principal limiting factors are therefore the need for valid credentials on the panel and that operators who have disabled or restricted the APS catalog for low-privileged roles will not be reachable by this specific attack path.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H drives the 9.9 score: the bug is network-reachable with low complexity, requires only a low-privileged authenticated session, no user interaction, and the scope change reflects that exploitation crosses from the constrained Plesk user context to the underlying OS. EPSS, KEV, POC, and SSVC signals were not provided in the input, so real-world exploitation probability cannot be quantitatively confirmed; the realistic risk is nonetheless high because Plesk panels frequently expose accounts to many tenants (hosting customers, resellers) who already satisfy the PR:L requirement. Note an apparent tension worth verifying: the description frames the outcome as 'local privilege escalation' while the CVSS vector is AV:N - this likely reflects that the attack is delivered remotely over the network against an authenticated panel session but results in OS-level command execution, rather than indicating a contradiction.

An attacker who has obtained or registered a low-privileged Plesk account - for example a shared-hosting customer or a reseller subaccount - navigates to the APS Application Catalog and submits a crafted search term whose XPath payload escapes the intended query and steers backend processing into invoking attacker-controlled OS commands. The resulting commands execute with the privileges of the Plesk service, giving the attacker code execution on the host and a pivot to other tenants' sites and data. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once the injection point is understood.