Plesk Obsidian CVE-2026-44962 — Authenticated XPath Injection to OS Command Execution in APS Application Catalog (CVSS 9.9)

Plesk Obsidian CVE-2026-44962 (TL-2026-0645) is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-06-01. It has no confirmed attribution, affects Plesk Plesk Obsidian (Linux) — APS Application Catalog component, references 1 CVE (CVE-2026-44962), maps to 10 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-0645

Threat ID
TL-2026-0645
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-01
Last reviewed
2026-06-01
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
hosting, technology, managed-service-providers, small-business, web-services
Target regions
Global
Detection rules
9
Indicators of compromise
12

A critical XPath injection flaw (CWE-643) in the APS Application Catalog search functionality of Plesk Obsidian allows a low-privileged authenticated user to inject into backend XPath queries against XML data and pivot to arbitrary operating-system command execution on the server. Network attack vector, low complexity, no user interaction, scope-changed — CVSS 9.9. Patched in Plesk 18.0.75 Update 1 and 18.0.76 Update 2 (late February 2026); CVE published 29 May 2026 with no public PoC or in-the-wild exploitation confirmed.

How Plesk Obsidian CVE-2026-44962 works

CVE-2026-44962 is a critical (CVSS 9.9) authenticated XPath injection vulnerability in the APS (Application Packaging Standard) Application Catalog search feature of Plesk Obsidian for Linux. The catalog search interface incorporates user-supplied search input directly into backend XPath queries against XML-based catalog data without adequate neutralization of XPath metacharacters (CWE-643: Improper Neutralization of Data within an XPath Expression). A low-privileged but authenticated panel user (for example a hosting subscriber/customer account) can craft search input containing XPath syntax — quotes, predicate brackets, boolean operators, and functions such as count(), string-length(), substring(), and contains() — to break out of the intended query context and alter query logic.

The immediate primitive is classic XPath injection: an attacker can subvert the boolean logic of the catalog lookup (e.g. injecting ' or '1'='1 style predicates) and blindly enumerate the structure and contents of the backing XML through node-count and character-extraction oracles, exfiltrating data the account should not be able to read. Because the catalog component processes results through backend application logic that ultimately invokes server-side operations, the advisories report that a crafted injection chains beyond pure data disclosure into arbitrary operating-system command execution on the underlying host. The CVSS vector reflects a scope change (S:C): the vulnerable web component is reachable by a constrained panel account, but successful exploitation impacts resources outside that account's security boundary, effectively transforming a minimal-privilege tenant into one capable of executing privileged actions on the server. In shared-hosting and multi-tenant Plesk deployments this enables lateral movement and full host compromise from a single low-tier customer credential.

The attack surface is network-reachable (AV:N) over the Plesk management interface, requires only low privileges (PR:L), low attack complexity (AC:L), and no user interaction (UI:N). No public proof-of-concept exploit code and no confirmed in-the-wild exploitation were available at the time of CVE publication; the issue was found through coordinated disclosure by security researcher Georgii Shutiaev working with Plesk via HackerOne (which is also the CVSS source of record). Plesk shipped fixes in Obsidian 18.0.75 Update 1 and 18.0.76 Update 2 during the 24–25 February 2026 maintenance window, well ahead of the 29 May 2026 public CVE/NVD disclosure. Where immediate patching is not feasible, administrators can disable the APS Catalog functionality via the panel configuration file at /usr/local/psa/admin/conf/panel.ini as a temporary mitigation. Given the trivial privilege requirement, network exposure of management panels, and the high concentration of Plesk on internet-facing shared-hosting infrastructure, unpatched instances should be treated as high-priority remediation targets.

MITRE ATT&CK techniques used in TL-2026-0645

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1083 File and Directory Discovery

Persistence

T1505 Server Software Component

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1552 Unsecured Credentials

Affected products and versions in Plesk Obsidian CVE-2026-44962

  • Plesk — Plesk Obsidian (Linux) — APS Application Catalog component
    Vulnerable versions: Plesk Obsidian for Linux prior to 18.0.75 Update 1; Plesk Obsidian for Linux 18.0.76 prior to Update 2
    Fixed in: 18.0.75.1 (18.0.75 Update 1); 18.0.76.2 (18.0.76 Update 2)

Remediation for Plesk Obsidian CVE-2026-44962

Patches

  • Plesk Obsidian 18.0.76 Update 2 (18.0.76.2)
  • Plesk Obsidian 18.0.75 Update 1 (18.0.75.1)

Immediate actions

  • Update Plesk Obsidian to 18.0.76 Update 2 (18.0.76.2) or 18.0.75 Update 1 (18.0.75.1) immediately.
  • If patching cannot be done at once, disable the APS Catalog functionality via /usr/local/psa/admin/conf/panel.ini as a temporary workaround.
  • Restrict network exposure of the Plesk management interface (8443/8880) to trusted source IPs / VPN only.

Workarounds

  • Disable the APS Application Catalog by editing /usr/local/psa/admin/conf/panel.ini (short-term only; not a substitute for patching).

Longer-term hardening

  • Audit all low-privilege panel/customer accounts and enforce least privilege; remove dormant or unused subscriber accounts.
  • Enable and centrally collect Plesk web access logs and host process auditing to detect command-execution attempts.
  • Adopt a patch-management SLA that applies Plesk security maintenance updates within the vendor release window.
  • Deploy host-based EDR on Plesk servers with rules for shell children of the web/panel service user.

CVEs associated with Plesk Obsidian CVE-2026-44962

CVE-2026-44962

Weaknesses (CWE) in Plesk Obsidian CVE-2026-44962

CWE-643

Timeline of Plesk Obsidian CVE-2026-44962

  • Plesk releases Obsidian 18.0.76 Update 2 (18.0.76.2) remediating the APS Catalog XPath injection as part of the 24–25 February 2026 security maintenance window.
  • Security researcher Georgii Shutiaev reports the APS Catalog XPath injection to Plesk via HackerOne under coordinated disclosure.
  • Plesk releases Obsidian 18.0.75 Update 1 (18.0.75.1) backporting the fix to the 18.0.75 branch.
  • CybersecurityNews and GBHackers publish technical reporting describing XPath-injection-to-command-execution in the Plesk APS Application Catalog.
  • CVE-2026-44962 published; NVD record live with CVSS 9.9 (HackerOne as CVSS source) and CWE-643 classification.
  • Threadlinqs Intelligence ingests CVE-2026-44962 and begins full threat analysis and detection engineering.

Sources cited for Plesk Obsidian CVE-2026-44962

Threats related to Plesk Obsidian CVE-2026-44962

Detection coverage for TL-2026-0645

As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0645 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats