Plesk CVE-2026-68487/68488 Combo Yields Server Root: Shared Hosting Most Exposed

Two bugs in Plesk for Linux backup manager: CVE-2026-68487 path traversal writes arbitrary root-owned files; CVE-2026-68488 symlink race for local priv-esc. Any customer account can exploit.

Plesk shipped a security update in Sep 2026 fixing two bugs in its backup manager: CVE-2026-68487 (unsigned backup header → path traversal, write arbitrary root-owned files) and CVE-2026-68488 (symlink race during restore → local privilege escalation). Combined, a normal Plesk customer account can escape a restricted hosting environment and obtain server root. Shared hosting is the highest-risk scenario.

Incident overview

Affected: Plesk for Linux 18.0.79.10 and earlier, and 18.0.80 through 18.0.80.6. Fixed: 18.0.79.11 and 18.0.80.7. Plesk for Windows is not affected. Both bugs sit in backup/restore: one lacks validation on write, one has a TOCTOU window on restore.

Technical details

CVE-2026-68487 is path traversal (CVSS 9.9). Backup file headers are not signature-checked. An attacker crafts a path with traversal sequences so the backup manager writes a file, as root, anywhere on the host filesystem. Because the writer is root, overwriting management files, planting a root-executed script, or writing cron jobs are all possible.

CVE-2026-68488 is a restore-phase symlink race (TOCTOU). During restore the attacker swaps the target path between check and use, so the operation lands outside the intended directory, yielding local privilege escalation. The key is that the checked path and the final write path are not the same object. Filename checks alone do not defend this.

Same-batch CVE-2026-67397 is the same class: path traversal lets a low-privilege user execute commands as root. Linux only.

Impact

Plesk is a high-volume hosting control panel. Millions of sites run on servers it manages. Single-tenant boxes are relatively contained. Real danger is shared hosting: anyone who can self-provision an account, or already holds a normal customer account, can attempt local priv-esc. Once root, the attacker reads other customers' databases and files, installs backdoors, establishes long-term persistence, and uses the box as a pivot. Customer isolation is gone.

Remediation

• Confirm version, then upgrade:

plesk version
plesk installer update

After upgrade, confirm version is at least 18.0.79.11 or 18.0.80.7. Plesk often auto-updates overnight, but this pair needs explicit confirmation the patch landed. Check host by host.

• Patch is step one. Instances historically exposed to the internet still need forensics: anomalous root-owned files recently appearing in customer and system dirs, new privileged accounts and sudo rules, modified cron, unexpected filenames in backup dirs;
• Restrict panel access by source IP, or put it behind VPN / a zero-trust gateway. Do not expose port 8443 to the whole internet;
• If exploitation is confirmed, treat it as server-level compromise. Rotate Plesk admin and database credentials. Integrity-compare suspicious files.

References

• Plesk KB: Backup manager path traversal
• Plesk KB: Symlink race privilege escalation during restore
• RimuHosting ops advisory: Plesk emergency update
• Enigma Global: Daily Threat Intelligence Digest 2026-09-12