CVE-2026-67394CWE-78command-injection

CVE-2026-67394

published September 1, 2026

CVSS
9.0
EPSS
1%
Percentile
70.0
In the wild
Unconfirmed
What it is

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

The record
Technical detail
CVSS
9.0 · NONE
CVSS v4.0
9.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01287 · 70.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-01T07:16Z
References (1)
https://support.plesk.com/hc/en-us/articles/42968165026967-CVE-2026-67394-Vulnerability-in-Plesk-allows-privilege-escalation-to-root · [email protected]
EPSS history
Timeline
  • 02 SEP 03:38Z
    EPSS moved — → 1%
    epss
  • 01 SEP 02:07Z
    A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before…
    cvelistv5