Plesk released hotfixes on 10 September 2026 for two critical vulnerabilities in Backup Manager: CVE-2026-68487 and CVE-2026-68488. Both let an authenticated customer or reseller write arbitrary root-owned files to the host filesystem, which is a direct path to full server compromise.
This is a multi-tenant problem. Any account that can run a backup or restore — every customer and reseller on the box — can reach the vulnerable code. Restricting panel access at the firewall does not help when the attacker is a legitimate low-privilege user, the same pattern as the August DNS and database CVEs and the Migrator root escalation.
What the vulnerabilities expose
| CVE | Mechanism | Impact |
|---|---|---|
| CVE-2026-68487 | Privilege escalation in Backup Manager | An authenticated customer or reseller writes arbitrary root-owned files to the host, escalating to root. |
| CVE-2026-68488 | Symlink race during subscription content restore | A TOCTOU race changes ownership of a directory outside the customer's own subscription, again yielding root-owned file writes. |
Both end in the same place: an unprivileged account gets root. Neither needs an existing administrator login.
Affected and patched versions
| Branch | Affected | Patched |
|---|---|---|
| Plesk for Linux 18.0.79 | 18.0.79.10 and earlier | 18.0.79.11 |
| Plesk for Linux 18.0.80 | 18.0.80 through 18.0.80.6 | 18.0.80.7 |
Plesk for Windows is not listed as affected. Older branches (18.0.78 and earlier) are out of support — move them to a patched build rather than waiting for a backport that will not come.
Check your version
Run as root:
plesk version | grep -E 'Version|OS'
Anything below 18.0.79.11 on the .79 branch, or below 18.0.80.7 on the .80 branch, needs the update. You can also confirm from the panel under Tools & Settings > Server Components.
Install the hotfix
Take a current server backup first, then pull the microupdate:
plesk installer update
Or from the panel: Tools & Settings > Updates and Upgrades, install the latest updates for your branch, then re-check the version under Server Components.
If plesk installer stalls or errors out — a stale lock, a broken repo, a half-applied prior update — work through fixing Plesk update failures before retrying. Do not leave the server on a partially updated build.
There is no supported workaround. Disabling Backup Manager for customers is not exposed as a clean per-server toggle, and turning off the backup subsystem breaks your own scheduled backups without reliably closing CVE-2026-68488's restore path. Patch instead — the microupdate is a few minutes.
After patching
Verify the version on every server in your fleet, not just the one you tested. A quick sweep:
for h in $(cat servers.txt); do
printf '%s ' "$h"
ssh -n "root@$h" "plesk version 2>/dev/null | awk '/Version/{print \$3}'"
done
Flag anything still on 18.0.79.10 / 18.0.80.6 or lower.
Which Plesk version fixes CVE-2026-68487 and CVE-2026-68488?+
Is Plesk for Windows affected by the September 2026 Backup Manager CVEs?+
How do I update Plesk from the command line?+
Can a regular customer exploit these vulnerabilities?+
Are these vulnerabilities being exploited in the wild?+
Next steps
- Plesk CVE-2026-65646, 65642, and 65647: patch your server
- Fix Plesk update failures
- Plesk repair utility commands
A current Plesk license keeps a server eligible for vendor microupdates like these hotfixes.