Critical· 9.9
CVE-2026-44962
Plesk's APS Application Catalog search functionality has an XPath injection vulnerability allowing authenticated, low-privileged users to execute arbitrary operating system commands and escalate privileges. CVSS 9.9 critical severity.
publishedMay 29, 2026
last modifiedJul 21, 2026
sourcesNVD
severity · cvss
9.9
critical · how bad it is
exploitation · epss
<1%
49th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 4, 2026
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
01
Who is affected
Users of Plesk with access to the APS Application Catalog search feature
02
Real-world impact
Local privilege escalation on the server via command execution
03
Why this severity
Critical: High confidence in exploitability and severe consequences for server control
04
What to do about it
no official fix yet
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
05
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →