Critical Plesk Vulnerability Let Users Execute Arbitrary Commands on the Server

Cybersecuritynews •Abinaya • June 1, 2026

A newly disclosed critical vulnerability in Plesk, tracked as CVE-2026-44962, is raising serious security concerns after researchers confirmed it can allow authenticated users to execute arbitrary operating system commands on affected servers. The issue, published in the National Vulnerability Database and GitHub Advisory Database, affects the APS Application Catalog component and has been assigned a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Plesk Vulnerability Allows Arbitrary Command Execution A critical vulnerability in Plesk, tracked as CVE-2026-44962, was disclosed on May 29, 2026. This flaw enables authenticated low-privileged users to execute arbitrary operating system commands on affected servers. The vulnerability is linked to improper input handling in the APS Application Catalog component of Plesk for Linux. Security researchers have raised alarms about the potential for exploitation, which could lead to significant impacts on server integrity and data security. The issue has been documented in both the National Vulnerability Database and GitHub Advisory Database. Administrators are urged to assess their systems for this vulnerability and apply necessary mitigations. The scope of impact includes all versions of Plesk that utilize the affected component. 2 sources 71

Extracted Entities

Critical Plesk Vulnerability Let Users Execute Arbitrary Commands on the Server

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)