CVE-2026-67394: Plesk for Linux Privilege Escalation Flaw

CVE-2026-67394 Overview

CVE-2026-67394 is a local privilege escalation vulnerability in Plesk for Linux caused by OS command injection [CWE-78]. The flaw affects all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. A customer or reseller account with shell access, or with permission to change their own shell access, can inject operating system commands to elevate privileges to the root account on the hosting server. The vulnerability grants full administrative control of the underlying host from a low-privileged tenant context.

Critical Impact
Any Plesk customer or reseller with shell access can execute arbitrary commands as root, resulting in full compromise of the shared hosting server and all tenants on it.

Affected Products

Plesk for Linux versions 18.0.34 through versions prior to 18.0.79.9
Plesk for Linux 18.0.80 versions prior to 18.0.80.5
Shared hosting environments where customers or resellers are granted shell access

Discovery Timeline

2026-09-01 - CVE-2026-67394 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-67394

Vulnerability Analysis

The vulnerability is classified as OS command injection [CWE-78] in a Plesk workflow that handles shell access configuration for customer and reseller accounts. When a tenant modifies shell-related settings, user-controlled input reaches a system command invocation without sufficient neutralization of shell metacharacters. The injected payload executes in the context of the Plesk management process, which runs with root privileges on the hosting server.

The attack requires authenticated access as a customer or reseller and a configuration state in which the account can invoke or modify its own shell assignment. Because the command execution occurs on the host operating system rather than inside a per-tenant chroot, the attacker escapes tenant isolation and obtains full control of every hosted site, database, and mailbox on the server.

Root Cause

The root cause is missing or insufficient sanitization of shell-related input passed to a privileged system call. Plesk composes a command string that incorporates attacker-controlled fields and passes it to a shell interpreter without escaping. Standard shell metacharacters such as ;, |, `, and $() enable command chaining that runs alongside the intended operation.

Attack Vector

The attacker authenticates to Plesk with a customer or reseller account. The attacker then triggers a shell access change or a related tenant operation that includes an injected command payload. Plesk executes the crafted string as root, giving the attacker a root shell, arbitrary file access, and the ability to modify system binaries, cron jobs, or SSH keys for persistence. No user interaction from an administrator is required. Refer to the Plesk Security Advisory CVE-2026-67394 for vendor-provided technical context.

Detection Methods for CVE-2026-67394

Indicators of Compromise

Unexpected processes spawned by the Plesk management daemon under the root UID immediately after a tenant shell access change.
New or modified entries in /root/.ssh/authorized_keys, /etc/passwd, /etc/shadow, or /etc/sudoers following customer or reseller activity.
Shell metacharacters such as ;, |, `, or $() present in Plesk audit logs for shell configuration operations.
New cron jobs in /etc/cron.d/, /var/spool/cron/, or systemd unit files created by tenant-triggered workflows.

Detection Strategies

Monitor Plesk panel and API logs for shell access modification requests originating from non-administrator accounts.
Correlate tenant-initiated configuration changes with subsequent root-owned process creation and outbound network connections.
Baseline the child process tree of Plesk service accounts and alert on deviations, particularly executions of /bin/sh, /bin/bash, curl, wget, or nc.
Deploy file integrity monitoring on privileged system files and cron directories to detect post-exploitation persistence.

Monitoring Recommendations

Enable verbose audit logging on Plesk and forward events to a centralized log platform for retention and search.
Alert on Plesk versions in the vulnerable range reported by asset inventory and vulnerability scanners.
Track authentication events for customer and reseller accounts with shell access privileges and review anomalous session activity.

How to Mitigate CVE-2026-67394

Immediate Actions Required

Upgrade Plesk for Linux to version 18.0.79.9, 18.0.80.5, or later on all affected hosts.
Audit customer and reseller accounts and revoke shell access where it is not operationally required.
Review Plesk audit logs since the earliest vulnerable version was installed for evidence of injection attempts.
Rotate root credentials, SSH keys, and API tokens on any server suspected of compromise.

Patch Information

Plesk has released fixed builds 18.0.79.9 and 18.0.80.5 that remediate the command injection. Apply the update through the Plesk auto-update mechanism or the vendor package repository. Full remediation details are available in the Plesk Security Advisory CVE-2026-67394.

Workarounds

Disable the ability for customers and resellers to change their own shell access setting in Plesk service plans.
Set shell access for tenant subscriptions to Forbidden or a restricted chrooted shell until patches are applied.
Restrict management panel access to trusted administrative networks using IP allowlists at the firewall or reverse proxy layer.

bash

# Configuration example
# Verify installed Plesk version
plesk version

# Trigger the Plesk auto-updater to apply the fixed build
plesk installer --select-release-current --show-components
plesk installer update

# List subscriptions and disable shell access for tenants as a temporary control
plesk bin subscription --list
plesk bin subscription -u <subscription-name> -shell /bin/false