Critical severity · published Sep 23, 2026
CVE-2026-87898
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges
9.4
CVSS
1.1%
EPSS
No
On KEV
Description
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
Plesk extension "Site Import" · WebPros
1.6.6 through 1.12.1 · source: vendor