CVE-2026-48614
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Risk Assessment
An attacker can gain full control over the server with root privileges, enabling modification of critical system files and installation of malware.
Recommendation
Immediately update Plesk to the latest patched version and restrict access to the XML API to trusted users only.
Original NVD description (English source)
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.