# CVE-2026-68488: Plesk TOCTOU race condition in symlink following

Source: https://junglewise.ai/threats/cve-2026-68488-plesk-toctou-race-condition-in-symlink-following  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-68488 · Severity: critical · CVSS 9.9 · Published 2026-09-10

Plesk is a web hosting control panel that manages servers and applications for hosting providers. A race condition vulnerability in Plesk's backup restoration process allows a local user to exploit a window of time between checks and file operations to create malicious symlinks, leading to unauthorized root-level access and complete server compromise.

Technologies: [Plesk](https://junglewise.ai/threats/technologies/plesk). Vendors: [Plesk](https://junglewise.ai/threats/vendors/plesk).

## Quick answers

**Is CVE-2026-68488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68488 being exploited in the wild.

**How severe is CVE-2026-68488?** Critical severity, with a CVSS score of 9.9, published 10 September 2026.

**Which products and versions are affected?** Plesk Plesk.

**Is there a fix for CVE-2026-68488?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-68488 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-68488?** Check whether you run Plesk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in Plesk's symlink handling, specifically triggered during backup restore operations. An attacker with local access can exploit the gap between the security check that validates a path or file and the subsequent file operation to redirect writes to arbitrary locations via symlink substitution. By gaining arbitrary file and directory ownership takeover, an attacker can escalate privileges to root. The attack requires local access but does not require prior authentication or elevated privileges to initiate. Patches are available from Plesk via their support portal.

## Affected products

- Plesk Plesk

## Timeline

- 2026-09-10: disclosed

## References

- [https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation](https://support.plesk.com/hc/en-us/articles/43248932867351-Vulnerability-in-Plesk-s-Backup-Manager-symlink-race-during-restore-allows-root-privilege-escalation)

## Related threats

- [Plesk OS command injection allows remote code execution](https://junglewise.ai/threats/cve-2026-87898-os-command-injection-in-plesk-allows-remote-authenticated-users)
- [Plesk untrusted search path arbitrary code execution](https://junglewise.ai/threats/cve-2026-68492-an-untrusted-search-path-vulnerability-in-plesk-from-18-0-34)
- [Plesk path traversal leading to arbitrary code execution as root](https://junglewise.ai/threats/cve-2026-67397-plesk-path-traversal-leading-to-arbitrary-code-execution-as-root)
- [Plesk symlink resolution vulnerability in file access](https://junglewise.ai/threats/cve-2026-65647-plesk-symlink-resolution-vulnerability-in-file-access)
- [Plesk DNS zone management improper neutralization of special elements](https://junglewise.ai/threats/cve-2026-65646-plesk-dns-zone-management-improper-neutralization-of-special)