External risk intelligence

Plesk OS Command Injection Allows Root Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-87898

Plesk is a web-based hosting control panel designed to be managed remotely over the internet. As an administrative interface that is typically exposed to the web for site administrators to manage their servers and services, it constitutes a commonly internet-facing management surface.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in the Plesk control panel, which could allow authenticated users to execute arbitrary code with root privileges by injecting operating system commands. The potential impact is significant, as it could lead to a complete compromise of the affected systems.

Command injection allows unauthorized code execution.
Critical Plesk vulnerability impacts system control.
Confirm relevance and potential system exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by gaining authenticated access to Plesk, a web-based server administration tool. From there, they could exploit a weakness in how the system processes certain commands. If successful, this could allow them to run any command with the highest level of system access.

Requires authenticated user access.
Triggers through OS command injection.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users to execute arbitrary commands on the server with root privileges. This could impact the integrity and availability of the Plesk service and the underlying operating system when supported by the advisory's conditions.

Server command execution with root privileges.
Remote authenticated user execution.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability in Plesk requires immediate attention from teams responsible for web hosting infrastructure and security. The first critical step is to inventory all Plesk instances, determine their internet reachability and business criticality, and then identify the specific system owners responsible for remediation planning.

Host and Security Teams own the issue.
Verify Plesk instances and their exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Plesk?

Plesk is a comprehensive web-based hosting control panel. It provides a graphical interface for administrators to manage websites, databases, email accounts, and server configurations without needing to interact directly with the command line for every task.

What does CVE-2026-87898 mean by OS command injection?

This vulnerability, classified as CWE-78, occurs when software improperly constructs a command string that is passed to the underlying operating system. Because the input isn't correctly sanitized, an attacker can append their own unauthorized commands to be executed by the server, potentially gaining full control over the system.

How does an attacker trigger this command injection?

An attacker must first obtain authenticated access to the Plesk interface. This flaw is not a direct entry point for unauthenticated users; the malicious command injection occurs only after the system processes inputs within an established user session.

Is my Plesk installation at risk?

Plesk is frequently deployed as an internet-facing management interface for remote server administration. According to Halo Surface Signal, this design makes it a primary, commonly exposed surface, meaning any instance reachable via the internet should be treated as a high-priority concern.

What steps should I take if I run Plesk?

Start by performing a complete inventory of all your Plesk instances to understand your total footprint. Determine which servers are accessible from the internet, identify the teams responsible for their maintenance, and prioritize those systems for update planning and risk mitigation.

References

support.plesk.com/hc/en-us/articles/43641151026583

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.