Immediate action: if you manage Plesk on Linux, verify the full version today. CVE-2026-67397 allows a Plesk user without elevated privileges to execute code as root and gain complete server control. Plesk Obsidian 18.0.79.9 and earlier, plus 18.0.80 through 18.0.80.5, are affected. Fixes are available in 18.0.79.10 and 18.0.80.6. Plesk for Windows is not affected.
Scope checked on September 2, 2026 against Plesk's official advisory. Plesk has not published a CVSS score, root cause, indicators of compromise, or observed-exploitation count; this article does not invent them.
Why CVE-2026-67397 is serious
The decisive detail is the boundary crossed: an ordinary panel account can reach root. On multi-tenant infrastructure, one valid account may escape its subscription and reach the entire operating system. Root can read configuration, databases, mail, and secrets; modify services; establish persistence; or erase evidence.
| Platform / branch | Status | Action |
|---|---|---|
| Plesk Linux 18.0.79.9 or earlier | Affected | Update to 18.0.79.10 or later |
| Plesk Linux 18.0.80–18.0.80.5 | Affected | Update to 18.0.80.6 or later |
| Plesk Linux 18.0.79.10 | Fixed | Verify the micro-update is installed |
| Plesk Linux 18.0.80.6 | Fixed | Verify the micro-update is installed |
| Plesk Windows | Not affected by this CVE | Keep the normal update cycle |
The confirmed public scope is two Plesk Linux branches and no Windows versions for this flaw. There is no reliable public count of vulnerable servers, and “affected” does not mean “compromised.” The official advisory provides capability and version ranges, not a victim census.
Check exposure in under a minute
In the panel, open Tools & Settings → About Plesk. Over SSH, use:
sudo plesk version
Compare the complete number, including the micro-update. /usr/local/psa/version may omit that precision; the UI or plesk version is a better definitive check.
- 18.0.79.9 or lower: affected.
- 18.0.80.0 through 18.0.80.5: affected.
- 18.0.79.10 or 18.0.80.6: contains the published fix.
How to update Plesk
Validate backups and console access first. In the UI: Tools & Settings → Updates → Install or Update Product → Continue. On Linux:
Isolate your sites on infrastructure you control
Deploy a KVM VPS and retain control of snapshots, networking, and the operating system while enforcing a serious update policy.
sudo plesk installer --select-release-latest --upgrade-installed-components
sudo plesk version
Plesk notes that the panel can be unavailable for several minutes while websites remain online; the installer uses port 8447. Keep a recovery path open.
Does updating prove the server is clean?
No. Updating closes the known path; it does not remove an earlier intrusion. Because the advisory provides no specific IOCs, public triage can only look for anomalies, not deliver a conclusive test.
sudo journalctl --since "2026-09-01" --priority=warning
sudo find /root/.ssh /etc/cron.d /etc/systemd/system -type f -newermt "2026-09-01" -ls
sudo ss -lntup
sudo getent passwd
These checks may surface recent persistence, listeners, and accounts, but can produce false positives and miss malicious activity. Also review /var/log/plesk/panel.log, authentication logs, root SSH keys, cron/systemd changes, unexpected web files, and shared credentials.
Response priority
| Scenario | Priority | Reason |
|---|---|---|
| Affected multi-customer panel | Critical | A tenant boundary may end at root |
| Affected single-admin panel | High | A Plesk account can still escalate locally |
| Patched now, exposed before | High for review | The patch cannot rule out earlier compromise |
| Plesk Windows | Routine | This specific CVE does not apply |
If you find suspicious evidence
- Isolate or restrict the host without destroying evidence.
- Capture timestamps, processes, connections, logs, and file changes.
- Rotate credentials and secrets after containment.
- Review systems sharing keys, tokens, or passwords.
- If root access cannot be ruled out, rebuild from trusted media and restore verified data.
Our earlier analysis of Plesk CVE-2026-65647 is also relevant: two distinct flaws can end in the same root-level impact, but they are not the same incident.
What is known—and unknown
We know the starting privilege, root impact, affected branches, and fixed builds. As of this update, no public root cause, exploit details, Plesk CVSS, IOCs, or incident count is available. The CVE was also absent from the CISA KEV snapshot checked on September 2; absence from KEV does not prove absence of exploitation.
FAQ
Is blocking public panel access enough?
It reduces exposure but is not a replacement for the patch: the described attacker already has a Plesk account.
Is Plesk for Windows vulnerable?
Not to CVE-2026-67397, according to Plesk's September 2 advisory.
Must I reinstall the whole server?
Not automatically. Patch and review if you only confirm an affected version. If evidence exists or root access cannot be ruled out, a trusted rebuild is safer than blind cleanup.
