XPath Injection Vulnerability in Plesk APS Application Catalog
CVE-2026-44962
Key Information:
Badges
What is CVE-2026-44962?
CVE-2026-44962 is a security vulnerability identified in the Plesk APS Application Catalog, a component of Plesk, which is a widely used web hosting and server management platform. This specific vulnerability involves XPath injection within the search functionality of the APS Application Catalog. By not properly sanitizing user-supplied input, the system allows authenticated but low-privileged users to manipulate XPath queries. This manipulation can lead to the execution of arbitrary operating system commands on the server, creating a pathway for local privilege escalation. As a result, an attacker can gain elevated access, potentially compromising not just the server environment but also the applications and services dependent on it.
Potential Impact of CVE-2026-44962
-
Local Privilege Escalation: The vulnerability enables low-privileged authenticated users to execute arbitrary commands, which can grant them higher privileges within the system, compromising its integrity and security.
-
Compromise of Server Integrity: With the ability to run system commands, malicious users can manipulate server configurations, access sensitive data, and alter or delete critical files, leading to significant data loss and operational disruption.
-
Increased Attack Surface for Ransomware: Although no known exploitations linked to ransomware have been reported, the exploitation of this vulnerability could potentially provide an entry point for ransomware attacks, as attackers may leverage the elevated privileges gained to introduce malicious payloads or encrypt critical data.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Plesk 18.0.75.1
Plesk 18.0.76.2
News Articles
It Security NewsCVE-2026-44962Critical Plesk Vulnerability Let Users Execute Arbitrary Commands on the Server - IT Security News
A newly disclosed critical vulnerability in Plesk, tracked as CVE-2026-44962, is raising serious security concerns after researchers confirmed it can allow authenticated users to execute arbitrary operating system commands on affected servers. The issue, published in the National Vulnerability Datab...
1 month ago
It Security NewsCVE-2026-44962Critical Plesk Vulnerability Lets Users Execute Server Commands - IT Security News
A newly disclosed critical vulnerability in Plesk is raising serious security concerns after researchers confirmed that low-privileged users can execute arbitrary commands on affected servers. Tracked as CVE-2026-44962, the vulnerability affects Plesk for Linux and is linked to improper input…Read m...
1 month ago