Critical SEVERITY — Vulnerability

CVE-2026-44962 — Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Platform
Plesk
CVE Record
CVE-2026-44962
CVSS Score
9.9/10
Published
29 May 2026
Views
17
Primary source: Review the official advisory at nvd.nist.gov Go to Source

Summary

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Assessment

  • CVE: CVE-2026-44962
  • CVSS base score: 9.9
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Source: NVD record

References

Action

  • Verify affected systems against your inventory
  • Apply the vendor patch during a maintenance window
  • Restrict access at the network layer until patched

Plesk — Related Advisories

VIEW ALL →