Vulnerability CVE-2026-68492: Arbitrary code execution as root in Plesk via the Plesk RESTful API extension

Situation

A security vulnerability CVE-2026-68492 was discovered in Plesk for Linux. It allows remote authenticated users to execute arbitrary code as root via the Plesk RESTful API extension.

Affected product version

Plesk versions before 18.0.34 and Plesk RESTful API versions before 2.4.2 are not affected.

Impact

A remote authenticated user can execute arbitrary code as root via the Plesk RESTful API extension.

The Plesk RESTful API extension is installed by default, although it is hidden in the Plesk interface. A server may therefore be affected even if the extension was not installed manually.

The vulnerability requires an affected version of both products at the same time: Plesk and the Plesk RESTful API extension. The extension is normally updated automatically. Confirm that version 2.4.7 or later is installed.

Call to action

1. Confirm that the Plesk RESTful API extension is 2.4.7 or later, as described below.

2. If the installed version is older than 2.4.7, force an update from the extension catalog:

   # plesk bin extension --install rest-api

3. Update Plesk Obsidian to 18.0.80.8 or 18.0.81.1 or later: How to update Plesk Obsidian to the latest build

How to confirm the patched version is installed

1. Connect to the server via SSH.

2. Check the version of the Plesk RESTful API extension:

   # plesk bin extension --get-xml-info rest-api

   The reported version must be 2.4.7 or later:

   CONFIG_TEXT: <?xml version="1.0"?>
   <module fullVersion="2.4.7-18178" status="true"/>

3. Verify that Plesk is running 18.0.80.8, 18.0.81.1, or later. See How to find version of Plesk installed on server for instructions.

Acknowledgements

We would like to thank Ali Mustafa (rz1027) for responsibly disclosing this vulnerability.