If you’re running Plesk for Linux, this is one security update you shouldn’t postpone. A newly disclosed Plesk vulnerability, tracked as CVE-2026-67397, allows a regular Plesk user with no elevated privileges to execute arbitrary code as root.
In practical terms, a standard hosting account on a shared server could potentially gain full control of the underlying server. Since shared hosting environments rely on strict isolation between users, this vulnerability can undermine that security model if left unpatched.
Hosting providers, MSPs, and businesses managing multiple Plesk servers should treat applying the latest update as a priority. If you need assistance applying security updates, verifying your Plesk environment, or hardening your Linux servers against emerging threats, our Support team can help ensure your hosting infrastructure remains secure and up to date.
What is CVE-2026-67397?
CVE-2026-67397 is a privilege escalation vulnerability affecting Plesk for Linux. The issue stems from a path traversal flaw that allows a local authenticated Plesk user to execute arbitrary commands with root privileges.
Since the attacker only needs a valid Plesk account, environments hosting multiple customers are at greater risk than dedicated single-user deployments. Fortunately, Plesk for Windows is not affected.
How the Plesk vulnerability works
Normally, every Plesk user is restricted to their own hosting environment. This isolation prevents one customer from accessing another customer’s websites, databases, or files.
This Plesk vulnerability breaks that isolation. By exploiting the path traversal flaw, a legitimate low-privileged user can escape those restrictions and execute commands as the root user.
Once root access is obtained, an attacker could:
- Access files belonging to other customers
- Read or modify databases
- Install malware or backdoors
- Create new privileged accounts
- Use the compromised server to attack other systems
- Maintain long-term persistence on the server
Since the attack starts with an ordinary user account, it doesn’t require administrator credentials.
Who is affected?
The vulnerability affects Plesk for Linux installations only. Plesk for Windows is not affected.
Which Plesk versions are vulnerable?
| Product | Affected versions | Patched version |
|---|---|---|
| Plesk for Linux | 18.0.79.9 or earlier | 18.0.79.10 |
| Plesk for Linux | 18.0.80 – 18.0.80.5 | 18.0.80.6 |
| Plesk for Windows | Not affected | Not applicable |
How to check your Plesk version
Before updating, verify the version currently installed on your server.
SSH into the server and run:
plesk versionAlternatively, you can check the version from the Plesk web interface by navigating to:
Tools & Settings → Plesk Information
If your installation matches any of the affected versions listed above, update it immediately.
How to update Plesk
After confirming your installed version, upgrade to the latest patched release.
You can update Plesk from the command line using:
plesk installer updateAlternatively, update through the Plesk Installer available from the web interface.
If you manage multiple servers, schedule updates across your entire infrastructure to ensure every server is running a patched version.
At Bobcares, we’ve seen security updates delayed because administrators postpone control panel upgrades during busy maintenance windows. However, vulnerabilities that allow privilege escalation should be prioritized, especially on shared hosting servers where a single compromised account can impact multiple customers.
Need Help Securing Plesk?
How to verify the patch
After completing the update, verify that the installation was successful.
Run:
plesk versionConfirm that your server reports one of the patched versions:
- 18.0.79.10 or later
- 18.0.80.6 or later
In addition, consider the following post-update checks:
- Confirm all Plesk services restarted successfully.
- Review authentication logs for unusual login attempts.
- Check for unexpected privileged user accounts.
- Review recently modified files in customer directories.
- Verify scheduled tasks and cron jobs for unauthorized changes.
- These verification steps help ensure the server is fully secured after patching.
Why this Plesk vulnerability is high risk
Many security vulnerabilities require phishing attacks, stolen credentials, or multiple exploit chains before an attacker can gain administrative access.
This Plesk vulnerability is different. An attacker only needs a legitimate low-privileged account to attempt exploitation. On shared hosting platforms, obtaining such an account is relatively easy, making this issue particularly concerning for hosting providers and organizations managing multiple customer websites.
Conclusion
The disclosure of CVE-2026-67397 highlights the importance of keeping control panels fully updated. Since this Plesk vulnerability allows a standard authenticated user to gain root privileges, affected Linux servers should be patched without delay.
After updating, verify the installed version and review your server for any signs of suspicious activity. Organizations managing multiple Plesk servers should ensure every system has received the latest security update.
To stay ahead of emerging threats, our Security Assessment Service helps identify vulnerabilities, prioritize remediation, and strengthen the overall security of your server infrastructure.
