Plesk CVE-2026-68488

Requires an authenticated low-privileged Plesk account (PR:L) with the ability to place/replace files in the Backup Manager restore working directory and to trigger a backup restore operation. Exploitation further requires winning a TOCTOU race window between the restore's path check and its privileged file operation, so success is timing-dependent and typically needs local filesystem access (shell/FTP) rather than pure remote interaction - this race requirement and the need for a valid account are the primary factors limiting real-world exploitation despite the high impact.

The CVSS 3.0 base score is 9.9 with a scope change (S:C), reflecting root-level confidentiality, integrity, and availability impact - the outcome is severe. However, the signals conflict on reachability: the vector states AV:N/AC:L, yet both the description ('local privilege escalation') and the exploitation mechanism (winning a filesystem symlink race that requires local file placement) point to a local vector and elevated attack complexity, so AV:N/AC:L appear overstated and should read closer to AV:L/AC:H. There is no EPSS figure, no KEV listing, and no published POC in the provided data, so this is a high-impact but not yet demonstrably weaponized issue; because it requires only a valid low-privileged Plesk account and yields root, any operator running multi-tenant Plesk hosting should treat patching as urgent regardless of the raw score. In practical terms the real priority is high for shared/reseller hosting environments where untrusted low-privilege accounts exist, and lower where only trusted administrators have accounts.

A malicious customer on a shared Plesk server with a low-privileged account initiates a backup restore, then rapidly swaps a file in the restore working path for a symlink pointing at a root-owned target. Winning the TOCTOU window, the root-run restore follows the link and reassigns ownership of the target to the attacker, who leverages that to obtain a root shell. No public exploit code is currently identified, and the race condition means exploitation may require repeated attempts.