What’s Vulnerable › Vulnerabilities

CVE-2026-87898

• Severity: critical (CVSS 9.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-23 · updated 2026-09-24
• Weakness: CWE-78

Description

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Affected products

• WebPros Plesk extension "Site Import": from 1.6.6 through 1.12.1

References

• https://support.plesk.com/hc/en-us/articles/43641151026583

Get alerted when CVE-2026-87898 or the next vulnerability affects your stack