CVE-2026-44962: Plesk XPath Injection Vulnerability

CVE-2026-44962 Overview

CVE-2026-44962 is an XPath injection vulnerability in the Plesk APS Application Catalog search functionality. The flaw allows user-supplied input to be interpolated directly into XPath queries without sanitization. An authenticated, low-privileged user can leverage this weakness to execute arbitrary operating system commands on the underlying server. Successful exploitation results in local privilege escalation and full host compromise. The issue is tracked under CWE-643 (Improper Neutralization of Data within XPath Expressions).

Critical Impact
Authenticated low-privileged Plesk users can escalate to arbitrary OS command execution on the server through crafted APS Catalog search input.

Affected Products

Plesk hosting control panel — APS Application Catalog component
Refer to the Plesk Security Advisory CVE-2026-44962 for affected version ranges

Discovery Timeline

2026-05-29 - CVE-2026-44962 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-44962

Vulnerability Analysis

The Plesk APS Application Catalog exposes a search interface that constructs XPath queries from user-supplied parameters. The search handler concatenates request input directly into the XPath expression evaluated against the catalog XML document. Because the input is not escaped or parameterized, an attacker can break out of the intended query context and inject arbitrary XPath syntax.

In this implementation, the XPath evaluation surface is wired into server-side code paths that ultimately invoke operating system commands. By injecting XPath fragments that influence downstream command construction, an authenticated user can pivot from query manipulation to arbitrary OS command execution. The result is local privilege escalation from a low-privileged Plesk account to the privilege level of the Plesk service.

Root Cause

The root cause is improper neutralization of input used in an XPath expression, classified as [CWE-643]. The APS Catalog search routine treats untrusted parameter data as trusted query syntax. No allowlist, escaping routine, or precompiled XPath template separates user data from the query structure.

Attack Vector

Exploitation requires network access to the Plesk management interface and valid low-privileged credentials. The attacker submits a crafted search request to the APS Application Catalog endpoint. The malicious payload alters the XPath query so that downstream logic executes attacker-controlled OS commands under the Plesk process identity. No user interaction is required, and the scope change extends impact beyond the vulnerable component to the host operating system.

No verified public exploit code is available at the time of writing. See the Plesk Security Advisory CVE-2026-44962 for vendor technical details.

Detection Methods for CVE-2026-44962

Indicators of Compromise

Unexpected child processes spawned by the Plesk web stack, especially shells (/bin/sh, /bin/bash) or interpreters launched from the APS Catalog request context.
HTTP requests to APS Catalog search endpoints containing XPath metacharacters such as ', ], or 1=1, string(, or system-property(.
New or modified files under Plesk web roots, cron directories, or /tmp immediately following catalog search activity.
Outbound network connections from the Plesk host to unfamiliar destinations after authenticated catalog interaction.

Detection Strategies

Inspect Plesk web server access logs for search parameters containing XPath operators or unusual encoded characters.
Correlate authenticated session activity with process creation events on the host to surface command execution chained from web requests.
Alert on Plesk service accounts executing administrative binaries (useradd, chmod, curl, wget) not associated with normal panel operations.

Monitoring Recommendations

Forward Plesk panel logs and host process telemetry to a centralized analytics platform for correlation.
Baseline normal APS Catalog request patterns and alert on deviations in parameter length, character classes, or request frequency.
Monitor authentication logs for low-privileged Plesk accounts performing catalog searches followed by privileged host actions.

How to Mitigate CVE-2026-44962

Immediate Actions Required

Apply the vendor-supplied update referenced in the Plesk Security Advisory CVE-2026-44962 as soon as it is available for your release channel.
Audit Plesk user accounts and remove or disable unused low-privileged accounts that could be abused for authenticated exploitation.
Restrict network access to the Plesk management interface to trusted administrative networks or VPN endpoints.

Patch Information

Plesk has published guidance under the advisory Vulnerability CVE-2026-44962 in Plesk's APS Catalog. Administrators should consult the advisory for fixed build numbers and apply updates through the standard Plesk update channel.

Workarounds

Disable or restrict access to the APS Application Catalog feature for non-administrative users until the patch is applied.
Enforce strong authentication, including multi-factor authentication, on all Plesk panel accounts to reduce the population of attackers able to authenticate.
Place a web application firewall in front of the Plesk panel and block requests to APS Catalog search endpoints containing XPath metacharacters.