CVE-2026-48614
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
Risk Assessment
An attacker can gain full control over the server with root privileges, enabling modification of critical system files and installation of malware.
Recommendation
Immediately update Plesk to the latest patched version and restrict access to the XML API to trusted users only.
Other vulnerabilities in Plesk
See all- CVE-2026-67394Critical
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. It allows a customer or reseller with shell access to elevate privileges to the root account on the hosting server.
- CVE-2026-64639Critical
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
- CVE-2026-64637Critical
Improper privilege management in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user account.
- CVE-2026-58046Critical
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
- CVE-2026-44962Critical
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
- CVE-2025-66430Critical
Plesk 18.0 has Incorrect Access Control.
- CVE-2026-67397High
A path traversal vulnerability in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
- CVE-2026-65647High
Plesk has a vulnerability involving improper symlink resolution before file access, allowing remote authenticated users to execute arbitrary code as root.
- CVE-2026-65646High
Plesk has a vulnerability involving improper neutralization of special elements, allowing remote authenticated users to disclose arbitrary local files and escalate privileges.
- CVE-2026-65642High
Plesk versions 18.0.79.7 and earlier, and 18.0.80 through 18.0.80.3, have an insecure direct object reference vulnerability, allowing remote authenticated users to read and modify other customers' databases.
Original NVD description (English source)
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.