Plesk CVE-2026-67394: OS Command Injection
Plesk is affected by CVE-2026-67394. A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a. Affected versions: 18.0.34 before 18.0.79.9 | 18.0.80 before 18.0.80.5. CVSS base score: 9.
Versiones afectadas
18.0.34 before 18.0.79.9 | 18.0.80 before 18.0.80.5
CMD de actualización por defecto
plesk installer --select-release-current --reinstall-patchComandos de corrección
AlmaLinux / Ubuntu / Debian / CloudLinux / Rocky Linux
plesk installer --select-release-current --reinstall-patch
plesk versionLo que esto significa bajo una licencia de SharedLicense
Your SharedLicense Plesk license itself is not affected — this is a vulnerability in Plesk, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.
A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-67394
Preguntas frecuentes
What is CVE-2026-67394?
Is CVE-2026-67394 being exploited in the wild?
How do I fix CVE-2026-67394?
Which versions are affected?
Referencias
Comprueba tu sistema en busca de vulnerabilidades
Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.
Comprueba tu sistema