CVE-2026-67394: WebPros Plesk

Critical severity, CVSS 9.0. EPSS: 1.3% chance of exploitation in the next 30 days.

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

Affected products

• WebPros Plesk: from 18.0.34, before 18.0.79.9 (fixed in 18.0.79.9); from 18.0.80, before 18.0.80.5 (fixed in 18.0.80.5)

Published 2026-09-01. Last modified 2026-09-03.