Plesk CVE-2026-68489: Code Injection
Plesk is affected by CVE-2026-68489. Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables. Affected versions: before 1.6.6 | before 2.5.0. CVSS base score: 8.7.
Затронутые версии
before 1.6.6 | before 2.5.0
Команда обновления по умолчанию
# Update the Ruby extension stack to the patched releaseКоманды исправления
All supported operating systems
# Update the Ruby extension stack to the patched release
# Plesk → Extensions → Updates → apply pending updatesЧто это значит по лицензии SharedLicense
Your SharedLicense Plesk license itself is not affected — this is a vulnerability in Plesk, not in licensing. Licenses continue to work during and after the update; there is no need to re-issue or re-activate anything. If you resell under your own brand, patch client servers too — unpatched installs put your reputation at risk, not your license.
Static Code Injection in Plesk extensions “Ruby” before 1.6.6 and “Node.js Toolkit” before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-68489
Часто задаваемые вопросы
What is CVE-2026-68489?
Is CVE-2026-68489 being exploited in the wild?
How do I fix CVE-2026-68489?
Which versions are affected?
Предупреждения о безопасности
Похожие предупреждения
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему