CRITICAL 9.0 NVD

CVE-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

References

Published: 2026-09-01 · Source: NVD · Feed updated: 2026-09-01
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-09-01 via NVD.

Risk Timeline

CVE Disclosed2026-09-01 · -1 days ago

Remediation Resources

Official Advisory
support.plesk.com/hc/en-us/articles/42968165026967-CVE-2026-67394-Vuln
vulnfeed aggregates 11489 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.