CVE-2026-68487Patch

LOWCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal

Weakness type (CWE)

CWE-36

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-09-11); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification4 categories

Patch

240.0%

Disclosure

120.0%

General

120.0%

PoC

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-10	1	Disclosure1
2026-09-11	3	General1Patch1PoC1
2026-09-14	1	Patch1

Full discourse5 posts

Rıdvan Yağlı@ridvanyagli46d
Disclosure
🔴 Plesk'te iki yeni kritik güvenlik açığı yayınlandı! CVE-2026-68487 — Backup Manager'da Path Traversal -> root olarak arbitrary file write. CVE-2026-68488 — Backup restore işleminde symlink race -> root privilege escalation. Her iki açık da Plesk for Linux sürümlerini etkiliyor. Etkilenen sürümler: 18.0.80.6 ve öncesi / 18.0.79.10 ve öncesi Yamalanmış sürümler: 18.0.80.7 / 18.0.79.11 Plesk kullanan sunucularınızı mutlaka güncelleyin! Duyurular: https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal
Post summary
Plesk announced two critical backup‑related vulnerabilities (CVE‑2026‑68487 and CVE‑2026‑68488) with detailed technical info and patched versions, urging users to update.
0101051.0K
2.4K followersView on X
ExploitGrid@exploitgrid45d
General
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-68487 CVE-2026-68488 CVE-2026-89049 CVE-2026-89094 CVE-2026-52098 ..🧵👇
Post summary
The digest merely enumerates several CVE identifiers without offering additional context on exploits, patches, or activity.
1001064
42 followersView on X
CCB Alert@CCBalert45d
Patch
Warning: A critical path traversal vulnerability in #Plesk Backup Manager allows arbitrary root file writes by authenticated customers. CVE-2026-68487 CVSS(3.0): 9.9. Read the advisory https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal and #Patch #Patch #Patch
Post summary
The post warns about a high‑severity path traversal flaw (CVE‑2026‑68487) in Plesk Backup Manager and directs readers to a vendor advisory with patch information.
01001289
7.2K followersView on X
ExploitGrid@exploitgrid45d
PoC
[CVE] CVE-2026-68487 [HIGH PRIORITY] 🔗 https://exploitgrid.net/cve/CVE-2026-68487
Post summary
The tweet references CVE‑2026‑68487 with a link to ExploitGrid, indicating a PoC exists but no exploitation tool, active use, or mitigation information is provided.
1000036
42 followersView on X
NEXSIGHT@NEXSIGHTNEWS43d
Patch
Plesk for Linuxのバックアップ機能にCVSS 9.9の脆弱性2件 — 顧客の一般権限からroot権限を奪われる恐れ、18.0.80.7／18.0.79.11で修正 https://cyber.nexsight.co/articles/2026/09/14/plesk-linux-backup-manager-cve-2026-68487-68488-root-2026-09-14/
Post summary
The text announces two critical CVSS 9.9 vulnerabilities in Plesk for Linux's backup feature and provides the specific fixed versions required for remediation.
0000062
70 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-68487

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

Plesk announced two critical backup‑related vulnerabilities (CVE‑2026‑68487 and CVE‑2026‑68488) with detailed technical info and patched versions, urging users to update.

ExploitGrid@exploitgridGeneral

The digest merely enumerates several CVE identifiers without offering additional context on exploits, patches, or activity.

CCB Alert@CCBalertPatch

The post warns about a high‑severity path traversal flaw (CVE‑2026‑68487) in Plesk Backup Manager and directs readers to a vendor advisory with patch information.

ExploitGrid@exploitgridPoC

The tweet references CVE‑2026‑68487 with a link to ExploitGrid, indicating a PoC exists but no exploitation tool, active use, or mitigation information is provided.

NEXSIGHT@NEXSIGHTNEWSPatch

The text announces two critical CVSS 9.9 vulnerabilities in Plesk for Linux's backup feature and provides the specific fixed versions required for remediation.