PT-2026-44902 · Plesk · Plesk

Georgii Shutiaev · Published 2026-05-29 · Updated 2026-06-06 · CVE-2026-44962

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Plesk versions prior to 18.0.75.1 Plesk versions prior to 18.0.76.2

Description An XPath injection issue exists in the APS Application Catalog search functionality. This occurs because user-supplied input is interpolated into XPath queries without proper sanitization. An authenticated, low-privileged user can exploit this to execute arbitrary operating system commands on the server, leading to local privilege escalation. Over 1.8 million devices were identified as potentially affected via FOFA queries in the past year.

Recommendations Update to version 18.0.75.1. Update to version 18.0.76.2.

Fix

LPE

Weakness Enumeration

CWE-643

Related Identifiers

CVE-2026-44962

Affected Products

Plesk

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-44962 · Security Note
• https://twitter.com/f1tym1/status/2061426209905344742 · Twitter Post
• https://twitter.com/UndercodeNews/status/2061399279604805742 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2061309348924834276 · Twitter Post
• https://twitter.com/dailytechonx/status/2061816365372133665 · Twitter Post
• https://twitter.com/fofabot/status/2061736532684271935 · Twitter Post
• https://twitter.com/UpwindMDR/status/2060625076521668873 · Twitter Post
• https://twitter.com/ustechninja/status/2063290437033513271 · Twitter Post
• https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog · Note
• https://twitter.com/threadlinqs/status/2061486339090985009 · Twitter Post