CVE-2026-44962Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog

Weakness type (CWE)

CWE-643

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
12 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 6 classified signals
General: 2 classified signals
Peaked 4d ago at 5 mentions (2026-06-01); latest day: 2
12 total mentions across 6 days

Deep dive

Activity timeline12 mentions / 6d

Signal classification3 categories

Disclosure

650.0%

Patch

433.3%

General

216.7%

Referenced assets12 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-30	1	Patch1
2026-06-01	5	Disclosure3General1Patch1
2026-06-02	2	Patch2
2026-06-03	1	Disclosure1
2026-06-06	1	General1
2026-06-08	2	Disclosure2

Full discourse12 posts

FOFA@fofabot133d
Patch
⚠️⚠️ CVE-2026-44962 (CVSS 9.9): Plesk's APS Application Catalog search is vulnerable to XPath injection, exposing the hosting control panel to unauthorized data extraction. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJwbGVzay1PYnNpZGlhbiI%3D 🎯1.8M+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="plesk-Obsidian" 🔖Refer: https://securityonline.info/plesk-privilege-escalation-flaw-patch/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post alerts to Plesk XPath injection CVE‑2026‑44962 with a CVSS of 9.9, notes extensive FOFA exposure, and points to a vendor patch.
012027112.8K
14.4K followersView on X
elhacker.NET@elhackernet134d
Disclosure
Vulnerabilidad crítica de Plesk permite ejecutar comandos arbitrarios en el servidor CVE-2026-44962 El problema radica específicamente en el componente APS Application Catalog https://blog.elhacker.net/2026/06/vulnerabilidad-critica-de-plesk-permite.html
Post summary
The post announces a critical Plesk vulnerability (CVE-2026-44962) affecting the APS Application Catalog that permits arbitrary command execution, with additional details likely to be found on the referenced blog.
0501662.1K
140.7K followersView on X
Gray Hats@the_yellow_fall134d
Patch
Secure your servers against a major Plesk privilege escalation flaw. Learn how the latest CVE-2026-44962 (CVSS 10) patch protects Linux infrastructure. #Plesk #Cybersecurity #Infosec #LinuxServer #Vulnerability https://securityonline.info/plesk-privilege-escalation-flaw-patch/ https://t.co/ScTS7yNpHG
Post summary
The post advertises a patch for the CVE‑2026‑44962 privilege‑escalation flaw in Plesk, highlighting its CVSS score and encouraging users to secure their Linux servers.
03021507
12.5K followersView on X
USTech.Ninja | Your Personal Ninja@ustechninja129d
General
🚨 Small Biz Vulnerabilities (June 2) 🚨 1️⃣ cPanel: Auth bypass (CVE-2026-41940) 2️⃣ Plesk: Root flaws (CVE-2026-44962) 3️⃣ GlobalProtect: CISA deadline passed 4️⃣ WordPress: Spectra/WP Maps Pro RCE Stay patched or stay exposed. 🌵🛡️ http://USTech.Ninja #CyberSecurity #SmallBiz https://t.co/c4lPE2nsUS
Post summary
The tweet enumerates several vulnerabilities affecting cPanel, Plesk, GlobalProtect, and WordPress with generic technical descriptors, urging users to keep systems patched, but it offers no PoC, exploit code, specific patches, or evidence of active exploitation.
00030142
60 followersView on X
Israel@f1tym1134d
Disclosure
Critical Plesk Vulnerability Let Users Execute Arbitrary Commands on the Server https://ift.tt/OpVBmFw A newly disclosed critical vulnerability in Plesk, tracked as CVE-2026-44962, is raising serious security concerns after researchers confirmed it can allow authenticated use…
Post summary
A newly disclosed critical Plesk vulnerability (CVE-2026-44962) permits authenticated users to execute arbitrary commands on the host; no PoC, exploit, patch, or active exploitation details are provided.
0100167
987 followersView on X
iototsecnews@iototsecnews127d
Disclosure
Plesk for Linux の脆弱性 CVE-2026-44962 が FIX：任意のコマンド実行の恐れ https://iototsecnews.jp/2026/06/01/critical-plesk-vulnerability-lets-users-execute-server-commands/ Plesk の脆弱性 CVE-2026-44962 は、プログラムがユーザーの入力を正しくチェックしない状態で処理してしまうことに起因します。具体的には、検索機能に入力された文字を、そのまま XPath クエリの命令に組み込んでしまうため、攻撃者による悪意の命令の実行が引き起こされてしまいます。データベースを扱う SQL インジェクションと比べて、見落とされがちな問題ですが、システムの深い部分と結びつくと、このようにサーバ全体を操作される深刻な事態に繋がります。ご利用のチームは、ご注意ください。 #CVE202644962 #Plesk #Vulnerability
Post summary
The post announces that CVE‑2026‑44962, a Plesk for Linux flaw that allows arbitrary command execution through XPath injection, has been fixed, but it provides no patch, PoC, or evidence of exploitation.
01000259
494 followersView on X
CERT-PY@CERTpy127d
Disclosure
⚠️ Vulnerabilidad en productos Plesk ❗ CVE-2026-44962 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-plesk/ https://t.co/bnqQsuRF1n
Post summary
A Spanish tweet announces the existence of CVE-2026-44962 affecting Plesk products and directs readers to a CERT link for more information, but provides no technical, exploit, or patch details.
0000067
6.7K followersView on X
セキュリティ対策Lab@securityLab_jp132d
Disclosure
PleskのAPS Catalogに致命的な脆弱性(CVE-2026-44962) https://rocket-boys.co.jp/security-measures-lab/plesk-aps-catalog-critical-vulnerability-cve-2026-44962/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces a critical vulnerability (CVE-2026-44962) in Plesk APS Catalog, linking to a security article, but offers no further technical, exploitation, or mitigation details.
0000098
412 followersView on X
The Daily Tech Feed@dailytechonx133d
Patch
Critical #Plesk vulnerability (CVE-2026-44962) allows authenticated users to execute arbitrary commands. Update to versions 18.0.76.2 or 18.0.75.1 immediately. #Plesk #CVE #Vulnerability #Exploit #RCE #CommandExecution #Patch #Update #Security #Cybersecurity #Hosting #Server #Linux #Admin #Threat #Risk #Mitigation #Infosec #Breach #ZeroDay Link: https://thedailytechfeed.com/critical-plesk-vulnerability-cve-2026-44962-allows-command-execution-urgent-patch-advised/
Post summary
The tweet announces a critical authenticated command execution vulnerability in Plesk (CVE-2026-44962) and urges users to immediately apply the specified patches.
0000053
354 followersView on X
ThreadLinqs@threadlinqs134d
Disclosure
NEW THREAT INTEL: Plesk Obsidian XPath Injection - CVE-2026-44962 (CVSS 9.9) lets auth user reach OS command exec. https://intel.threadlinqs.com/threat/TL-2026-0645 #ThreatIntel #CyberSecurity #RCE https://t.co/AE1re5NbJa
Post summary
New threat intel reports a high‑severity XPath injection (CVE‑2026‑44962) in Plesk Obsidian that enables authenticated users to execute OS commands.
0000071
54 followersView on X
UNDERCODE NEWS@UndercodeNews134d
General
🚨 #CVE-2026-44962: A Perfect 100 Vulnerability Puts Thousands of #Linux #Hosting Servers at Risk + Video -Fact Checker: ✅: 3 ❌: 0 || 3/3 → Score: 100% 🟢 -Prediction: 🟢 2 Positive | 🔴 2 Negative http://undercodenews.com/cve-2026-44962-a-perfect-100-vulnerability-puts-thousands-of-linux-hosting-servers-at-risk-video/
Post summary
The tweet announces CVE‑2026‑44962 and links to a news article, but provides no concrete technical details, PoC, exploit code, or evidence of exploitation.
0000052
881 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨Critical - Plesk APS Catalog XPath Injection (CVE-2026-44962) Plesk contains a critical XPath injection vulnerability in the APS Application Catalog search functionality. User-supplied input is interpolated into XPath queries without proper sanitization, allowing an authenticated low-privileged user to execute arbitrary operating system commands on the server. This leads to local privilege escalation with Critical severity (CVSS 9.9). 👉Fixed versions: Plesk 18.0.76.2 and 18.0.75.1
Post summary
The tweet announces a critical XPath injection in Plesk APS Catalog (CVE‑2026‑44962) with CVSS 9.9 and lists repaired releases 18.0.76.2 and 18.0.75.1.
0000079
196 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-44962

FOFA[verified]@fofabotPatch

The post alerts to Plesk XPath injection CVE‑2026‑44962 with a CVSS of 9.9, notes extensive FOFA exposure, and points to a vendor patch.

Israel[verified]@f1tym1Disclosure

A newly disclosed critical Plesk vulnerability (CVE-2026-44962) permits authenticated users to execute arbitrary commands on the host; no PoC, exploit, patch, or active exploitation details are provided.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The post announces a critical vulnerability (CVE-2026-44962) in Plesk APS Catalog, linking to a security article, but offers no further technical, exploitation, or mitigation details.

The Daily Tech Feed[verified]@dailytechonxPatch

The tweet announces a critical authenticated command execution vulnerability in Plesk (CVE-2026-44962) and urges users to immediately apply the specified patches.

ThreadLinqs[verified]@threadlinqsDisclosure

New threat intel reports a high‑severity XPath injection (CVE‑2026‑44962) in Plesk Obsidian that enables authenticated users to execute OS commands.

UNDERCODE NEWS[verified]@UndercodeNewsGeneral

The tweet announces CVE‑2026‑44962 and links to a news article, but provides no concrete technical details, PoC, exploit code, or evidence of exploitation.

Upwind Security MDR[verified]@UpwindMDRPatch

The tweet announces a critical XPath injection in Plesk APS Catalog (CVE‑2026‑44962) with CVSS 9.9 and lists repaired releases 18.0.76.2 and 18.0.75.1.

elhacker.NET@elhackernetDisclosure

The post announces a critical Plesk vulnerability (CVE-2026-44962) affecting the APS Application Catalog that permits arbitrary command execution, with additional details likely to be found on the referenced blog.