What is the CVSS score of CVE-2026-48614?

CVE-2026-48614 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Plesk are affected by CVE-2026-48614?

Plesk hosting control panels face a critical vulnerability enabling any authenticated user-staff member or customer-to gain root access to underlying servers.. A patch is available.

How to fix or mitigate CVE-2026-48614?

Within 24 hours: Inventory all Plesk instances; restrict panel access to administrative networks only via IP whitelisting; disable the XML API if not operationally required. Within 7 days: Audit and disable all non-essential user accounts; enable comprehensive logging of XML API and administrative actions; deploy detection rules for exploitation attempts. Within 30 days: Monitor Plesk vendor advisories for patch release; establish rapid patch testing and deployment procedures; conduct forensic review of all hosted servers for signs of prior unauthorized access.

Plesk CVE-2026-48614

EUVD-2026-41892 CRITICAL

Code Injection (CWE-94)

2026-07-06 hackerone

GHSA-29pr-6qrg-q2x4

Privilege Escalation RCE Code Injection Red Hat Plesk Webpros

9.9

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

XML API is network-reachable (AV:N/AC:L) but needs a valid low-privileged account (PR:L); root file write escapes the app boundary (S:C) giving full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.9 CRITICAL

qualitative

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 19:02 EUVD

Analysis Generated

Jul 06, 2026 - 18:25 vuln.today

DescriptionCVE.org

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

AnalysisAI

Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Plesk is a widely used commercial server administration and web hosting control panel (vendor WebPros, CPE cpe:2.3:a:webpros:plesk) that exposes an XML-RPC style management interface known as the XML API for programmatic provisioning of domains, mail, and service configuration. The root cause is CWE-94 (Code/Directive Injection) combined with a missing authorization check: the API accepts configuration input from an authenticated user without properly restricting which directives that user is allowed to set, so attacker-controlled content is written into privileged configuration handled by root-owned service processes. Because the injected directives are ultimately materialized to disk by a root context, this yields arbitrary file write as root rather than a confined application-level change.

RemediationAI

Apply the fix described in the Plesk vendor advisory (https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API) - patch available per vendor advisory, though an exact fixed version number is not confirmed in the available data, so verify the target build against that article before and after updating and enable Plesk automatic updates. As compensating controls until patched, restrict network access to the XML API endpoint (typically the panel management interface on port 8443) to trusted management IPs via firewall rules, which blocks remote abuse but will break any legitimate automation calling the API from other hosts; additionally, audit and reduce the number of low-privileged reseller/customer accounts and rotate credentials, since exploitation requires an authenticated account, accepting the operational overhead of tighter tenant access. Do not rely on this being unauthenticated-safe - any valid panel login is sufficient.