CVE-2026-87898

Awaiting Analysis Awaiting Analysis - Queue

OS Command Injection in Plesk with Root Privilege Escalation

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: HackerOne

Description

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-87898

EUVD

EUVD-2026-85618

Affected Vendors & Products

Vendor	Product	Version / Range
plesk	plesk	*
plesk	site_import	to 1.12.2 (exc)
plesk	site_import	From 1.12.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-87898 is an OS command injection flaw in Plesk's Site Import extension. It allows remote authenticated users to execute arbitrary code with root privileges due to improper quoting of database names in commands.

Detection Guidance

Check the installed version of the Plesk Site Import extension by logging into Plesk, navigating to Extensions > My Extensions, and verifying if the version is 1.12.1 or earlier. If so, the system is vulnerable.

Impact Analysis

Affected users may face unauthorized root-level access, exposing server configurations, databases, credentials, and other subscriptions. Attackers could manipulate server settings or steal sensitive data.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Plesk Site Import extension to version 1.12.2 or later through Extensions > My Extensions. After updating, confirm the new version is displayed to ensure the vulnerability is patched.

Hi! I’m here to help you understand CVE-2026-87898. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70