CVE-2026-68489CWE-96

CVE-2026-68489

published September 15, 2026

CVSS
8.7
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00674 · 51.6th percentile
Weakness
CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Published
2026-09-15T01:17Z
References (1)
https://support.plesk.com/hc/en-us/articles/43473204617239 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 14 SEP 20:53Z
    Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as…
    cvelistv5