CVE-2026-87898: Plesk OS Command Injection RCE Vulnerability

CVE-2026-87898 Overview

CVE-2026-87898 is an operating system command injection vulnerability in Plesk that allows remote authenticated users to execute arbitrary commands with root privileges. The flaw is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker with low privileges can leverage the flaw to fully compromise the underlying host, its data, and any tenant sites managed by the Plesk control panel.

Critical Impact
Authenticated attackers can execute arbitrary OS commands as root, resulting in complete compromise of the Plesk server and all hosted workloads.

Affected Products

Plesk (see vendor advisory for affected versions)

Discovery Timeline

2026-09-23 - CVE-2026-87898 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-87898

Vulnerability Analysis

CVE-2026-87898 is an OS command injection defect within Plesk, a widely deployed hosting control panel. The vulnerability enables an authenticated user to inject shell metacharacters into a parameter that is passed to an operating system command interpreter without adequate neutralization. Because Plesk components execute with elevated privileges, injected commands run as root, granting the attacker full control of the host.

The issue is network-reachable and requires only low privileges to exploit. No user interaction is needed. Once exploited, the impact extends beyond the vulnerable process: attackers can pivot to hosted websites, databases, mail services, and any tenant workloads under Plesk management.

Root Cause

The underlying defect is improper neutralization of special elements in an OS command, tracked as CWE-78. User-controlled input reaches a shell invocation without sanitization or safe API use, allowing metacharacters such as ;, |, &, and backticks to break out of the intended command context.

Attack Vector

An attacker authenticates to the Plesk interface with any account that can reach the vulnerable endpoint. The attacker submits crafted input containing shell metacharacters through the affected functionality. Plesk passes the input to a system shell running as root, and the injected commands execute with those privileges. Refer to the Plesk Support Article for endpoint-specific technical details.

Detection Methods for CVE-2026-87898

Indicators of Compromise

Unexpected processes spawned by Plesk service accounts or root, especially shells such as /bin/sh, /bin/bash, nc, curl, or wget invoked from Plesk components.
Outbound network connections initiated by Plesk PHP or Perl processes to unfamiliar external hosts.
New or modified files in system directories, cron entries, or SSH authorized_keys created by Plesk process trees.
Web access logs showing authenticated POST requests containing shell metacharacters like ;, |, `, or $( in parameter values.

Detection Strategies

Correlate Plesk authentication events with subsequent process execution to spot low-privilege accounts triggering root-level command activity.
Alert on child processes of Plesk services that deviate from a baseline of expected binaries.
Inspect HTTP request bodies and query strings sent to Plesk endpoints for command injection payload patterns.

Monitoring Recommendations

Forward Plesk access logs, auth.log, and process telemetry to a centralized analytics platform for retention and correlation.
Monitor /var/log/plesk/ and related audit trails for administrative actions preceding suspicious system activity.
Track file integrity on directories such as /etc, /root, and web document roots for unauthorized changes.

How to Mitigate CVE-2026-87898

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Plesk Support Article as soon as possible.
Restrict network access to the Plesk management interface to trusted administrative networks using firewall rules or a VPN.
Audit all Plesk user accounts, disable unused accounts, and rotate credentials for any account that could reach the vulnerable functionality.
Review host and hosted-site artifacts for signs of prior exploitation before returning systems to normal operations.

Patch Information

Consult the Plesk Support Article for the fixed version and update procedure. Apply the update through the Plesk updater or the vendor-recommended package management workflow, and verify the installed version after upgrade.

Workarounds

If patching must be delayed, restrict access to the Plesk panel to a small allowlist of administrator IP addresses.
Enforce strong authentication, including multi-factor authentication, on all Plesk accounts to reduce the population of users who could exploit the flaw.
Temporarily disable non-essential Plesk extensions or features associated with the vulnerable endpoint if identified in the vendor advisory.

bash

# Example: restrict Plesk panel access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 8443 -s 203.0.113.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP