# CVE-2026-67394: Plesk for Linux privilege escalation via OS command injection

Source: https://junglewise.ai/threats/cve-2026-67394-plesk-for-linux-privilege-escalation-via-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67394 · Severity: info · Published 2026-09-01

Plesk is a widely-used hosting control panel that manages web servers, email, and customer accounts on Linux systems. A critical vulnerability allows customers or resellers with shell access to execute arbitrary commands as the root user, gaining complete control over the hosting server and all customer data it contains.

Vendors: [Plesk](https://junglewise.ai/threats/vendors/plesk).

## Quick answers

**Is CVE-2026-67394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67394 being exploited in the wild.

**How severe is CVE-2026-67394?** Informational severity, published 1 September 2026.

**Which products and versions are affected?** Plesk for Linux 18.0.34 before 18.0.79.9 and before 18.0.80.5.

**Is there a fix for CVE-2026-67394?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67394 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-67394?** Check whether you run Plesk for Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a local privilege escalation vulnerability in Plesk for Linux, rooted in OS command injection. The vulnerable component allows shell-accessible users (customers or resellers with shell permissions enabled) to inject operating system commands that are executed with root privileges. The attack requires local shell access or the ability to enable shell access on the account. Successful exploitation results in complete system compromise with root-level code execution, potentially exposing all customer data and hosted applications. The vulnerability affects Plesk versions 18.0.34 through 18.0.79.9 and up to 18.0.80.5; updates are available in later patch releases.

## Affected products

- Plesk Plesk for Linux 18.0.34 before 18.0.79.9 and before 18.0.80.5

## Timeline

- 2026-09-01: disclosed

## References

- [https://support.plesk.com/hc/en-us/articles/42968165026967-CVE-2026-67394-Vulnerability-in-Plesk-allows-privilege-escalation-to-root](https://support.plesk.com/hc/en-us/articles/42968165026967-CVE-2026-67394-Vulnerability-in-Plesk-allows-privilege-escalation-to-root)