CVE-2026-67394
Received Received - Intake

Local Privilege Escalation in Plesk for Linux

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: HackerOne

Description
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-67394
EUVD
EUVD-2026-68921

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
plesk plesk From 18.0.34 (inc) to 18.0.79.9 (exc)
plesk plesk 18.0.79.9
plesk plesk 18.0.80.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-67394 is a critical local privilege escalation vulnerability in Plesk for Linux. It allows a customer or reseller with shell access to execute OS commands and escalate privileges to root on the hosting server. The flaw affects versions from 18.0.34 up to but not including 18.0.79.9 and 18.0.80.5.

Detection Guidance

Check Plesk version using 'plesk version' command. If running 18.0.34 to 18.0.79.8, the system is vulnerable. Review shell access permissions for customers and resellers via Plesk admin panel.

Impact Analysis

If exploited, this vulnerability could allow an attacker with limited access to gain full control of the server. This could lead to unauthorized data access, modification, or deletion, installation of malicious software, or disruption of services. The impact is severe as it compromises the entire hosting environment.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized access to sensitive data. Organizations may face legal penalties, loss of customer trust, and reputational damage if such an incident occurs.

Mitigation Strategies

Update Plesk to version 18.0.79.9, 18.0.80.5, or later immediately. If shell access is not required, disable it as a temporary measure until patching is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart