CVE-2026-87898

Plesk, a widely deployed hosting control panel, contains an OS command injection flaw (CWE-78) that lets a remote authenticated user run arbitrary operating-system commands with root privileges. An attacker with any valid Plesk account (including low-privileged reseller or customer logins, depending on the affected component) could submit crafted input that Plesk passes unsafely to a shell, escalating from panel access to full control of the underlying server. Because Plesk servers host customer websites, email, and databases, successful exploitation means complete compromise of every tenant and service on the box, with cross-system impact reflected in the CVSS 4.0 score of 9.4 (critical). The attack requires network access and an authenticated session, but no user interaction. There is currently no known public proof of concept and the flaw is not on the CISA KEV catalog, so exploitation status is none known.

What to do: Apply the vendor's fix immediately via Plesk Updates as soon as the patched release is available, and check the Plesk security advisory for the exact fixed version. Because exploitation requires a valid login, audit Plesk user and reseller accounts for unknown or dormant credentials, enforce MFA, and restrict access to the control panel port (8443) to trusted IPs via firewall rules. Review server logs and the Plesk panel log for unexpected command execution or new cron jobs/SUID binaries, and inspect hosted sites for webshells if compromise is suspected.