Plesk CVE-2026-87898

Exploitation requires a valid authenticated Plesk session at low privilege (PR:L) - any customer-, reseller-, or subscription-level account suffices; the attacker then reaches a panel function that passes attacker input into an OS command. It is remotely reachable over the network with low complexity and no user interaction, but the authentication requirement is the primary limiting factor: fully anonymous exploitation is not indicated. The specific vulnerable feature/endpoint and the affected Plesk versions are not stated in the available data and must be confirmed against the vendor advisory to scope which deployments are exposed.

This is a genuine high-priority vulnerability, not a paper-tiger high-CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, base 9.4) describes network-reachable, low-complexity OS command injection that requires only low-privilege authentication and yields arbitrary code execution as root - the SC/SI/SA:H metrics reflect that the injected commands escape the panel's privilege boundary to fully control the host OS. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation; the risk here is driven by impact and low barrier rather than by observed in-the-wild activity. The one signal that tempers urgency is PR:L: an attacker needs a valid Plesk login (any tenant/reseller/customer-level account), so this is realistically a privilege-escalation and multi-tenant-breakout risk rather than a fully anonymous internet worm. The single reference is a Plesk support article whose contents were not retrievable, so affected versions and the exact vulnerable feature could not be confirmed from the input - verify with the vendor advisory before scoping remediation.

An attacker who holds or phishes any low-privilege Plesk account (e.g., a shared-hosting customer or reseller login) submits crafted input to a panel function that passes it unsanitized to an OS command, breaking out to run arbitrary commands as root. This yields full host takeover and compromise of every other tenant on the server. No public proof-of-concept was provided, but the low attack complexity makes weaponization straightforward once the vulnerable endpoint is known.