CVE-2026-68488Patch

MEDIUMCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation

Weakness type (CWE)

CWE-367

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-09-11); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Patch

360.0%

General

120.0%

PoC

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-10	1	Patch1
2026-09-11	2	General1PoC1
2026-09-13	1	Patch1
2026-09-24	1	Patch1

Full discourse5 posts

Rıdvan Yağlı@ridvanyagli46d
Patch
🔴 Plesk'te iki yeni kritik güvenlik açığı yayınlandı! CVE-2026-68487 — Backup Manager'da Path Traversal -> root olarak arbitrary file write. CVE-2026-68488 — Backup restore işleminde symlink race -> root privilege escalation. Her iki açık da Plesk for Linux sürümlerini etkiliyor. Etkilenen sürümler: 18.0.80.6 ve öncesi / 18.0.79.10 ve öncesi Yamalanmış sürümler: 18.0.80.7 / 18.0.79.11 Plesk kullanan sunucularınızı mutlaka güncelleyin! Duyurular: https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation https://support.plesk.com/hc/en-us/articles/43248841638551-Vulnerability-in-Plesk-s-Backup-Manager-unsigned-backup-header-allows-path-traversal
Post summary
Plesk announced two critical Linux CVEs that enable root privilege escalation via path traversal and a symlink race, and it provides patched versions and urges immediate update.
0101051.0K
2.4K followersView on X
ExploitGrid@exploitgrid45d
General
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-68487 CVE-2026-68488 CVE-2026-89049 CVE-2026-89094 CVE-2026-52098 ..🧵👇
Post summary
This is a concise daily digest that enumerates several CVE identifiers without offering technical details, exploit information, or remediation guidance.
1001064
42 followersView on X
iototsecnews@iototsecnews33d
Patch
Plesk Backup Manager の脆弱性 CVE-2026-68488 が FIX：root 権限への昇格の恐れ https://iototsecnews.jp/2026/09/13/plesk-backup-manager-flaw-lets-low-privileged-users-gain-root-access-to-servers/ サーバ管理ツールである Plesk の Plesk Backup Manager において、権限の低いユーザーが Linux サーバの root 権限を取得できてしまう深刻な不具合が見つかりました。この問題は復元処理時の不具合に起因し、権限昇格による基盤システムの完全な占有／不正なファイル所有権の変更といった重大な影響を引き起こします。対象の脆弱性は CVE-2026-68488 (Plesk Backup Manager のシンボリックリンク競合状態 )です。悪用を防ぐ対策として、修正版である Plesk Obsidian 18.0.80.7 または 18.0.79.11 以降への迅速なアップデートと異常な所有権変更の調査が求められます。 #BackupManager #CVE202668488 #Plesk #Vulnerability
Post summary
The text announces the fix for CVE-2026-68488, a symbolic link race condition in Plesk Backup Manager allowing root privilege escalation, and explicitly urges users to update to specific patched versions (18.0.80.7 or 18.0.79.11+).
00010102
515 followersView on X
ExploitGrid@exploitgrid45d
PoC
[CVE] CVE-2026-68488 [HIGH PRIORITY] 🔗 https://exploitgrid.net/cve/CVE-2026-68488
Post summary
The tweet references CVE-2026-68488 and links to an ExploitGrid page, implying the availability of a proof‑of‑concept or exploit code, but gives no additional technical or mitigation details.
1000041
42 followersView on X
The Daily Tech Feed@dailytechonx44d
Patch
New Plesk security alert: a symlink race condition in Backup Manager (CVE-2026-68488) allows users with just FTP and panel access to gain root on Linux servers. Affects Plesk for Linux versions 18.0.80.6- and 18.0.79.10- branches. Patch to 18.0.80.7+ or 18.0.79.11+, especially if you run shared or multi-tenant hosting. Admins should hunt for unexpected file ownership changes and suspicious symlinks—your isolation may not be safe. #Cybersecurity #Plesk #Linux #PrivilegeEscalation #WebHosting #SecurityPatch https://thedailytechfeed.com/critical-plesk-backup-manager-bug-lets-users-become-root-on-linux-servers/
Post summary
The tweet highlights a symlink race condition in Plesk Backup Manager that can give root via FTP, lists affected versions, and urges updating to patched releases and monitoring for suspicious file changes.
0000082
727 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-68488

Rıdvan Yağlı[verified]@ridvanyagliPatch

Plesk announced two critical Linux CVEs that enable root privilege escalation via path traversal and a symlink race, and it provides patched versions and urges immediate update.

The Daily Tech Feed[verified]@dailytechonxPatch

The tweet highlights a symlink race condition in Plesk Backup Manager that can give root via FTP, lists affected versions, and urges updating to patched releases and monitoring for suspicious file changes.

ExploitGrid@exploitgridGeneral

This is a concise daily digest that enumerates several CVE identifiers without offering technical details, exploit information, or remediation guidance.

iototsecnews@iototsecnewsPatch

The text announces the fix for CVE-2026-68488, a symbolic link race condition in Plesk Backup Manager allowing root privilege escalation, and explicitly urges users to update to specific patched versions (18.0.80.7 or 18.0.79.11+).

ExploitGrid@exploitgridPoC

The tweet references CVE-2026-68488 and links to an ExploitGrid page, implying the availability of a proof‑of‑concept or exploit code, but gives no additional technical or mitigation details.