CVE-2026-68487 describes a path traversal flaw in Plesk's Backup Manager component. An authenticated user can exploit this vulnerability to write arbitrary files with root privileges, potentially leading to full system compromise. The vulnerability is classified under CWE-36 (Absolute Path Traversal). The CVSS v3.0 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. The scope is changed, and confidentiality, integrity, and availability impacts are all high.

Successful exploitation allows an authenticated customer to write arbitrary files as root, which can lead to full system compromise, including unauthorized access, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the Backup Manager to trusted users only and monitor for suspicious activity related to file writes.