High severity · published Sep 14, 2026
CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom…
8.7
CVSS
0.7%
EPSS
No
On KEV
Description
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
Plesk extension "Node.js Toolkit" · WebPros
before 2.5.0 · source: vendor
PE
Plesk extension "Ruby" · WebPros
before 1.6.6 · source: vendor
Affected product
PE
Plesk extension "Node.js Toolkit"
WebPros