Plesk CVE-2026-68489: Code Injection
Plesk is affected by CVE-2026-68489. Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables. Affected versions: before 1.6.6 | before 2.5.0. CVSS base score: 8.7.
प्रभावित संस्करण
before 1.6.6 | before 2.5.0
डिफ़ॉल्ट अपडेट कमांड
# Update the Ruby extension stack to the patched releaseसुधार कमांड
All supported operating systems
# Update the Ruby extension stack to the patched release
# Plesk → Extensions → Updates → apply pending updatesSharedLicense लाइसेंस के तहत इसका अर्थ
Your SharedLicense Plesk license itself is not affected — this is a vulnerability in Plesk, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.
Static Code Injection in Plesk extensions “Ruby” before 1.6.6 and “Node.js Toolkit” before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-68489
अक्सर पूछे जाने वाले प्रश्न
What is CVE-2026-68489?
Is CVE-2026-68489 being exploited in the wild?
How do I fix CVE-2026-68489?
Which versions are affected?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें