CVE-2026-68492

UNKNOWN

Description

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Timeline

Published:September 23rd, 2026 8:17 PM

Last modified:September 24th, 2026 9:16 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-426

References & Reports

Advisories, patches, and third-party reports

https://support.plesk.com/hc/en-us/articles/43644058632983

Source: NIST NVD · Data may lag official sources by up to one minute