EUVD-2026-41892
GHSA-29pr-6qrg-q2x4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged Plesk account
-
DeliveryReach XML API endpoint
-
ExploitInject unauthorized configuration directives
-
ExecutionArbitrary file write as root
-
ImpactEscalate to full root control of server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Plesk account (CVSS PR:L) with the ability to reach the Plesk XML API - for example a reseller or customer login on a multi-tenant hosting server - and the ability to send crafted API requests injecting configuration directives. The specific product feature required is the Plesk XML API endpoint being network-reachable by the attacker (default on the panel management port). Limiting factors: the attacker must first possess valid panel credentials (no anonymous/unauthenticated path per the CVSS vector), so risk is highest on shared hosting where many semi-trusted users have accounts; no user interaction, no non-default configuration, and no specific client platform are needed beyond a working account and API access. |
| Impact | This is a genuine high-priority issue, not an inflated CVSS number. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9) indicates remote, low-complexity exploitation requiring only a low-privileged authenticated account, with a scope change reflecting the jump from the Plesk application boundary to root on the host - consistent with the described arbitrary-file-write-as-root outcome. The single limiting factor is the PR:L requirement: an attacker needs some valid Plesk credential (e.g. a reseller or customer panel login), which is common in shared/multi-tenant hosting where many semi-trusted users hold accounts. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input; absence of KEV/POC data means active exploitation is not confirmed, but the low complexity and full-root impact make this an attractive target once details or exploits emerge. There are no conflicting signals in the supplied data - the description (authenticated user) and the CVSS PR:L both agree on authenticated access. |
| Exploit ScenarioDerived | A tenant on a shared Plesk server (or an attacker who has phished or purchased a low-privileged reseller/customer login) authenticates to the panel and issues crafted XML API requests that smuggle unauthorized configuration directives into a root-owned service config. The injected directives are written to disk as root, letting the attacker plant or overwrite a privileged file (e.g. a cron job, service unit, or web server config) and escalate to full root control of the host. No user interaction and only low attack complexity are required per the CVSS vector; no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fix described in the Plesk vendor advisory (https://support.plesk.com/hc/en-us/articles/41171817973143-Vulnerability-in-Plesk-XML-API) - patch available per vendor advisory, though an exact fixed version number is not confirmed in the available data, so verify the target build against that article before and after updating and enable Plesk automatic updates. As compensating controls until patched, restrict network access to the XML API endpoint (typically the panel management interface on port 8443) to trusted management IPs via firewall rules, which blocks remote abuse but will break any legitimate automation calling the API from other hosts; additionally, audit and reduce the number of low-privileged reseller/customer accounts and rotate credentials, since exploitation requires an authenticated account, accepting the operational overhead of tighter tenant access. Do not rely on this being unauthenticated-safe - any valid panel login is sufficient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Plesk is a widely used commercial server administration and web hosting control panel (vendor WebPros, CPE cpe:2.3:a:webpros:plesk) that exposes an XML-RPC style management interface known as the XML API for programmatic provisioning of domains, mail, and service configuration. The root cause is CWE-94 (Code/Directive Injection) combined with a missing authorization check: the API accepts configuration input from an authenticated user without properly restricting which directives that user is allowed to set, so attacker-controlled content is written into privileged configuration handled by root-owned service processes. Because the injected directives are ultimately materialized to disk by a root context, this yields arbitrary file write as root rather than a confined application-level change.
Know when Plesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
XML API is network-reachable (AV:N/AC:L) but needs a valid low-privileged account (PR:L); root file write escapes the app boundary (S:C) giving full C:H/I:H/A:H.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Executive ViewAI
Plesk hosting control panels face a critical vulnerability enabling any authenticated user-staff member or customer-to gain root access to underlying servers. This affects all hosted applications and data across the organization's infrastructure, with no vendor patch currently available. Immediate containment measures are essential to prevent service disruption and data compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable XML API functionality unless critical to operations; (2) Implement strict IP-based access controls limiting panel logins to administrative networks; (3) Remove all non-critical user accounts; (4) Segment Plesk infrastructure from customer environments through network isolation; (5) Enable audit logging for all XML API calls and configuration modifications; (6) Deploy filesystem integrity monitoring to detect unauthorized changes; (7) Require multi-factor authentication on all panel accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inje
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-
OS command injection in Plesk allows any authenticated low-privilege panel account - customer, reseller, or subscription
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Authenticated Plesk panel users can escalate to root on Plesk 18.0 (Obsidian) servers by exploiting incorrect access con
Exploit-DB