CVE-2026-67394: CWE-78 OS Command Injection in WebPros Plesk

This vulnerability (CVE-2026-67394) is an OS command injection issue classified under CWE-78 in WebPros Plesk for Linux. It enables local privilege escalation by allowing an attacker with limited shell access to execute commands that elevate their privileges to root. The affected versions include all releases from 18.0.34 up to but not including 18.0.79.9 and 18.0.80.5. The CVSS 4.0 base score is 9.0, indicating critical severity with network attack vector, low attack complexity, and partial privileges required. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

An attacker who is a customer or reseller with shell access, or who can modify their shell access, can exploit this vulnerability to gain root privileges on the hosting server. This results in full control over the affected system, potentially compromising all hosted services and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shell access permissions for customers and resellers to trusted users only and monitor for suspicious privilege escalation attempts.