Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Plesk can let local users gain root access

CVE-2026-68488 · published 29 days ago
Summary

A timing flaw in Plesk lets a local user trick the system into following a malicious shortcut, which can give them full administrator (root) rights. This could allow the attacker to take control of any file or folder on the server. Install the latest Plesk updates and limit local user privileges until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
webpros plesk <= 18.0.80.6
Original advisory text
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published10 Sep 2026
Updated7 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-68488 · NVD
CVE-2026-68488 · MITRE
Track software like this
Free during beta