Critical Plesk Vulnerability (CVE-2026-44962) Exposes Linux Servers to Full Takeover A severe security flaw in WebPros Plesk, a widely used web hosting control panel, has been discovered, allowing authenticated low-privilege attackers to execute arbitrary OS commands and gain full server control. Tracked as CVE-2026-44962, the vulnerability carries a CVSS 3.1 score of 10.0, the highest possible severity rating, posing a critical risk to Linux hosting environments globally. The flaw resides in Plesk’s APS Application Catalog search functionality, where user-supplied input is improperly sanitized before being interpolated into XPath queries. Classified as CWE-643 (Improper Neutralization of Data within XPath Expressions), this injection vulnerability enables attackers to manipulate query structures, bypass security controls, and trigger unauthorized system-level operations. Key Details: - Disclosure Date: May 29, 2026 (via coordinated bug bounty program). - Attack Requirements: Network-accessible, no user interaction, low attack complexity, and only a low-privilege authenticated session (e.g., a standard hosting account). - Impact: Arbitrary OS command execution, full local privilege escalation, and high risk to confidentiality, integrity, and availability. - Affected Systems: Plesk for Linux with the APS Catalog feature enabled. This vulnerability follows a prior critical flaw (CVE-2025-66430) disclosed months earlier, which allowed privilege escalation via Apache configuration injection. Patch & Mitigation: Plesk released fixes on February 24–25, 2026, for the following versions: - Plesk 18.0.76.2 (February 25, 2026) - Plesk 18.0.75.1 (February 24, 2026) Administrators are advised to apply updates immediately. For environments unable to patch, Plesk recommends disabling the APS Catalog feature by adding the following to `/usr/local/psa/admin/conf/panel.ini` and restarting services: ``` [aps] enabled = off ``` The vulnerability was responsibly disclosed by security researcher Georgii Shutiaev, who coordinated with Plesk to ensure a patch was available before public release. Hosting providers, managed service providers, and enterprises running Plesk on Linux are urged to prioritize remediation due to the flaw’s high severity and ease of exploitation.