CVE-2026-67394 Command injection in Plesk
Local attackers with shell access can execute arbitrary commands to escalate privileges to root on Plesk for Linux servers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67394?
CVE-2026-67394 is a critical command injection vulnerability in WebPros Plesk, published on 1 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.
Weakness: CWE-78
Which versions are affected by CVE-2026-67394?
How do I fix CVE-2026-67394?
No fix has been published for CVE-2026-67394 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-67394 being exploited?
There is no known exploitation of CVE-2026-67394 in the wild and no public exploit code.
Sources
Also known as GHSA-2mjp-rg6q-cc58.