EUVD-2026-85621
GHSA-9584-9pgw-4m7q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Plesk as low-priv user
-
DeliveryPlant malicious file on untrusted search path
-
ExploitInvoke RESTful API extension code path
-
ExecutionRoot process loads attacker file
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path verification
|
| Exploitation Conditions | Requires a Plesk server running the 'Plesk RESTful API' extension at version 2.4.2 through 2.4.6 (fixed in 2.4.7), on Plesk core 18.0.34-<18.0.80.8 or 18.0.81-<18.0.81.1. The attacker must hold valid authenticated Plesk credentials (PR:L) - any low-privilege panel account suffices; no admin rights or user interaction are needed and the vector is network-reachable. The primary limiting factor is that the RESTful API extension must be installed and at a vulnerable version, and the attacker must be able to write to (or influence) the untrusted search-path directory consulted by the root-context process; hosts without this extension are not affected. |
| Impact | This is a genuinely high-priority flaw despite thin external signal. The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, low-privilege path to full-triad root-level compromise - a realistic escalation for any tenant on a shared Plesk host. The dangerous combination is PR:L plus code execution as root: any authenticated panel account (reseller, customer, or limited admin) can become root on the underlying server. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this reflects targeted/undisclosed risk rather than proven mass exploitation. Note the report originated via HackerOne (support@hackerone.com), consistent with a coordinated-disclosure research finding rather than in-the-wild activity. One data caveat: the vendor 4.0 vector sets subsequent-system impact (SC/SI/SA) to N, which slightly understates that gaining root is effectively a full-host takeover crossing a privilege boundary - a CVSS 3.1 modeling would arguably warrant S:C. Overall: treat as a priority patch for any multi-tenant Plesk deployment running the RESTful API extension, but there is no evidence of widespread active exploitation. |
| Exploit ScenarioDerived | An attacker with a low-privilege authenticated Plesk account (e.g., a hosting customer or reseller) targets a server where the 'Plesk RESTful API' extension (2.4.2-2.4.6) is installed. They place a malicious library or executable in a directory that a root-context Plesk API process searches before the trusted location, then trigger the vulnerable code path so the untrusted file is loaded and executed as root. No public POC or exploit code is currently identified, and exploitation is remote but requires valid panel credentials (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Arbitrary code execution as root is achievable on affected Plesk servers by any authenticated panel user who can influence a directory on the untrusted search path used by the Plesk RESTful API extension. Exploitation requires Plesk core 18.0.34 through 18.0.80.7 or 18.0.81 (i.e., below 18.0.80.8 / 18.0.81.1 respectively) together with the 'Plesk RESTful API' extension at versions 2.4.2 through 2.4.6; the vector is network-reachable, needs only low-privilege credentials (PR:L per the CVSS 4.0 vector) and no user interaction, making a full root compromise of the hosting panel feasible from an ordinary subscription account. Independent assessment rates this a genuinely high-priority flaw despite thin external signal, since successful exploitation yields complete loss of confidentiality, integrity and availability on the panel host (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.7 with S:U/C:H/I:H/A:H). No public exploit code identified at time of analysis, and no EPSS or CISA KEV data corroborates active exploitation; vendor fixes are available in Plesk 18.0.80.8 / 18.0.81.1 and extension 2.4.7.
RemediationAI
Upgrade immediately to Plesk core 18.0.80.8 (for the 18.0.34-18.0.80.x branch) or 18.0.81.1 (for the 18.0.81 branch), and update the 'Plesk RESTful API' extension to 2.4.7 - the vendor-released patch versions for this issue, described in https://support.plesk.com/hc/en-us/articles/43644058632983. Because the flaw requires the extension to be present, a valid interim compensating control is to uninstall or disable the 'Plesk RESTful API' extension on any host that does not need it; the trade-off is loss of REST-based automation and any integrations that depend on that API. If the extension must remain in use before patching, restrict network access to the panel's REST API listener (Plesk HTTPS on port 8443, and the extension's own endpoint) to trusted administrative source addresses via firewall rules, and tighten panel accounts by removing unused or stale low-privilege logins, since any single valid account is sufficient to trigger the untrusted-search-path load - this reduces but does not eliminate risk for accounts that must retain access. Additionally, monitor the filesystem paths consulted by the root-context API process for unexpected file creation or modification by panel users, and treat such events as potential exploitation attempts. Do not rely on version-agnostic hardening alone: the only complete fix is moving both the core and the extension to the patched versions listed above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-426, Untrusted Search Path: a component running in a privileged (root) context resolves an executable, library or script through a search path that an attacker with limited privileges can write to or manipulate, so attacker-supplied content is loaded and executed with root rights. Here the vulnerable surface is the 'Plesk RESTful API' extension (versions 2.4.2 through 2.4.6, fixed in 2.4.7) as shipped on Plesk core 18.0.34 through 18.0.80.7 and 18.0.81 through 18.0.81.0, both of which are affected branches fixed in 18.0.80.8 and 18.0.81.1. The extension exposes an HTTP/REST interface on the panel, so the attack path is remote (AV:N) and, per the supplied CVSS 4.0 vector with PR:L and UI:N, only requires a valid low-privilege authenticated session - no administrator rights and no victim interaction. Subsequent-system metrics in the CVSS 4.0 vector (SC:N/SI:N/SA:N) indicate the impact is confined to the vulnerable Plesk host itself rather than chaining into downstream systems. Notably, the independently assessed vector is CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which is consistent with the CVSS 4.0 base score of 8.7 and confirms that the CVSS 4.0 environmental/threat metrics (E:X, CR:X, etc.) were left undefined rather than indicating reduced severity. No CPE identifiers were provided in the source data, so affected installations must be identified by Plesk core version plus installed extension version rather than by CPE matching.
Know when Plesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity path exploitable by any authenticated low-priv user (PR:L) yielding root code execution (C/I/A:H); S:U aligns with vendor's SC/SI/SA:N, though S:C→9.9 is defensible given low-priv-to-root escalation.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
Executive ViewAI
Plesk hosting panels running affected core and RESTful API extension versions can be fully compromised by an ordinary authenticated panel user, allowing root-level control of the server and all hosted subscriptions. This creates a material risk of data breach, service outage, and lateral movement across customer environments, so security leadership should treat exposed Plesk estates as high priority until mitigations are in place.
No vendor-released patch identified at time of analysis; disable or remove the Plesk RESTful API extension if not required, restrict Plesk panel/API access to trusted networks, enforce MFA and least privilege, audit panel users and directory permissions, monitor for unexpected root-level activity, and isolate affected Plesk hosts from sensitive internal networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inje
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper
OS command injection in Plesk allows any authenticated low-privilege panel account - customer, reseller, or subscription
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Exploit-DB