CVE-2026-48614: Plesk XML API Privilege Escalation Flaw

CVE-2026-48614 Overview

CVE-2026-48614 is an improper authorization vulnerability in the Plesk XML API. Authenticated users can inject arbitrary configuration directives into server components processed with elevated privileges. Successful exploitation results in arbitrary file write as root, enabling full privilege escalation on the underlying server. The flaw is classified under CWE-94: Improper Control of Generation of Code. Plesk published an advisory addressing the issue and provided fixed builds through its support portal.

Critical Impact
An authenticated attacker with low privileges can escalate to root on the host running Plesk, gaining complete control of the web hosting server and every domain, database, and mailbox it serves.

Affected Products

Plesk (XML API component) — refer to the vendor advisory for exact affected builds
Plesk Obsidian installations exposing the XML API
Any Plesk-managed server accepting authenticated XML API requests

Discovery Timeline

2026-07-06 - CVE-2026-48614 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-48614

Vulnerability Analysis

The Plesk XML API accepts structured requests that manipulate hosting objects including domains, mail accounts, and server configuration. The vulnerability stems from missing authorization checks on operations that write configuration directives consumed by root-owned services. An authenticated user with restricted permissions can craft an XML API request that injects directives outside their permitted scope. The Plesk backend, running as root, writes those directives to system-controlled files. This code-injection class flaw ([CWE-94]) turns any low-privileged Plesk account into a full host takeover primitive. The Exploit Prediction Scoring System places CVE-2026-48614 in the upper tier of likely-exploited issues given its network reachability and low attack complexity.

Root Cause

The XML API dispatcher trusts directive fields supplied in authenticated requests without validating that the requesting principal is authorized to modify the target configuration surface. Authorization is enforced at the API entry point but not on the individual directive handlers that ultimately write to root-owned files.

Attack Vector

An attacker authenticates to Plesk with any valid account, including a customer or reseller account. The attacker sends an XML API request containing directives that write attacker-controlled content to filesystem locations processed as root, such as service configuration files or scripts executed during periodic tasks. When the target service reloads or the scheduled task runs, the injected content executes with root privileges. Refer to the Plesk Support Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-48614

Indicators of Compromise

Unexpected XML API POST requests to /enterprise/control/agent.php originating from low-privileged Plesk accounts.
New or modified files under /etc/, /usr/local/psa/, or web server configuration directories with timestamps matching XML API activity.
Unexpected cron entries, systemd units, or shell hooks created outside of normal administrative windows.
New SUID binaries or shell payloads dropped into world-readable directories following authenticated Plesk sessions.

Detection Strategies

Audit Plesk panel.log and xml_api logs for requests containing directive fields inconsistent with the authenticated user's role.
Alert on file integrity monitoring events for Plesk-managed configuration paths written by the psa service outside of patch or admin windows.
Correlate authenticated Plesk session identifiers with subsequent root-owned file changes on the host.

Monitoring Recommendations

Forward Plesk application logs and Linux audit (auditd) events for /etc and /usr/local/psa to a centralized SIEM for correlation.
Baseline normal XML API usage per account role and alert on deviations such as configuration directive submissions from customer-tier accounts.
Monitor process creation trees where psa or sw-engine spawns shells or writes executable content.

How to Mitigate CVE-2026-48614

Immediate Actions Required

Apply the Plesk fixed build referenced in the Plesk Support Vulnerability Advisory as soon as available.
Restrict network access to the Plesk XML API endpoint to trusted management IP ranges.
Audit all Plesk user accounts and disable or reset credentials for accounts that are unused or shared.
Review the host for signs of unauthorized configuration changes, new cron jobs, and unexpected SUID binaries.

Patch Information

Plesk has issued guidance and updated builds through its vendor advisory. Administrators should upgrade to the fixed Plesk build identified in the Plesk Support Vulnerability Advisory and validate the running version through plesk version after applying the update.

Workarounds

Block external access to the XML API endpoint at the perimeter firewall or reverse proxy until patching is complete.
Limit XML API access to the loopback interface and require SSH tunneling for administrative automation.
Temporarily disable non-administrative Plesk accounts that do not require active access.

bash

# Restrict XML API access to trusted management network via iptables
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

# Verify installed Plesk version after patching
plesk version