CVE-2026-67397: WebPros Plesk

High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

Affected products

• WebPros Plesk: before 18.0.79.9 (fixed in 18.0.79.9); from 18.0.80, before 18.0.80.5 (fixed in 18.0.80.5)

Published 2026-09-04. Last modified 2026-09-08.