CVE-2026-68492: patch the Plesk REST API root RCE

Plesk has released fixes for CVE-2026-68492, a vulnerability that lets a remote authenticated user execute arbitrary code as root through the Plesk RESTful API extension. It affects Plesk for Linux only when the server has both an affected Plesk build and an affected extension version.

The RESTful API extension is installed by default but hidden, so not seeing it in the normal extension list does not prove that a server is safe. Check the Plesk build and extension version separately, then update each affected component.

Affected and fixed versions

A server is vulnerable only when both conditions are true:

1. Plesk for Linux is running 18.0.34 through 18.0.80.7, or 18.0.81.0.
2. The installed RESTful API extension is version 2.4.2 through 2.4.6.

For example, an affected Plesk build paired with RESTful API extension 2.4.7 is not vulnerable to this issue. Likewise, extension 2.4.6 does not make a Plesk build before 18.0.34 vulnerable to CVE-2026-68492.

See the official Plesk CVE-2026-68492 advisory for the vendor's version matrix.

Check the Plesk and extension versions

Connect to the server as root and run both commands:

plesk version
plesk bin extension --get-xml-info rest-api

The first command reports the installed Plesk build. In the XML returned by the second command, locate the RESTful API extension version. Check it even if the extension does not appear in the normal extension list: Plesk installs this extension by default and hides it.

Do not stop after checking only plesk version. An affected core build is not enough on its own, and an updated Plesk build does not establish which RESTful API extension version is installed.

Install both fixes

Take a current server backup, then update an old RESTful API extension with:

plesk bin extension --install rest-api

Update Plesk and its installed components with:

plesk installer --select-release-latest --upgrade-installed-components

Plesk also documents the supported update paths in How to update Plesk Obsidian to the latest build.

After both commands complete, repeat the version checks:

plesk version
plesk bin extension --get-xml-info rest-api

Confirm that Plesk reports at least 18.0.80.8 on the 18.0.80 line or 18.0.81.1 on the 18.0.81 line, and that the RESTful API extension reports 2.4.7 or later. If the installer fails, resolve the underlying error with the Plesk update failure guide, then run and verify the updates again.

Post-patch review — general incident-response guidance

The following steps are general incident-response guidance, not Plesk-specific indicators of exploitation. Installing the fixed versions closes this vulnerability but does not determine whether an affected authenticated account used it before the update.

If the server ran with both affected components, consider reviewing:

• Plesk administrator, reseller, and customer accounts for unexpected users, password changes, or API keys;
• Plesk and web-server logs for unusual authenticated REST API activity;
• root SSH keys, privileged users, sudoers entries, scheduled tasks, and systemd services for unexplained changes;
• recently created or modified files in privileged system and Plesk directories;
• outbound connections and unfamiliar listening processes around the relevant exposure period.

If you find suspicious privileged activity, isolate the host, preserve relevant logs and disk evidence, rotate credentials from a trusted system, and follow your incident-response process. A rebuild from known-good sources may be appropriate when system integrity cannot be established.

Next steps

• Use the Plesk REST API with reseller and customer accounts
• Fix Plesk update failures
• Configure the Plesk Firewall extension
• Plesk repair utility commands

A current Plesk license keeps supported installations eligible for vendor updates and security fixes.