PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44962 WebPros CVE debrief

Plesk's APS Application Catalog search functionality contains an XPath injection vulnerability (CWE-643) where user-supplied input is interpolated into XPath queries without proper sanitization. An authenticated attacker with low privileges can exploit this to execute arbitrary operating system commands, achieving local privilege escalation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact across confidentiality, integrity, and availability—resulting in a critical 9.9 score. The vulnerability was published to NVD on 2026-05-29 and remains in 'Awaiting Analysis' status. Plesk has published official guidance via their support portal. No known exploitation in ransomware campaigns has been documented (KEV: false).

Vendor
WebPros
Product
Plesk
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-08-14
Advisory published
2026-05-29
Advisory updated
2026-08-14

Who should care

Plesk hosting providers, shared hosting administrators, web hosting security teams, and organizations using Plesk for server management should prioritize this vulnerability due to the common deployment model where multiple low-privileged users share Plesk-managed infrastructure.

Technical summary

The APS Application Catalog in Plesk fails to sanitize user input before incorporating it into XPath queries. This XPath injection flaw allows authenticated users with minimal permissions to manipulate query logic and ultimately execute arbitrary commands on the underlying operating system. The vulnerability represents a significant privilege escalation path, as low-privileged web users can gain full system control. The changed scope (S:C) in CVSS scoring indicates the vulnerable component impacts resources beyond its security authorization.

Defensive priority

critical

Recommended defensive actions

  • Apply patches from Plesk when available per vendor security advisory
  • Restrict APS Catalog search functionality access to administrative users only until patching
  • Monitor authentication logs for unusual APS Catalog search patterns from low-privileged accounts
  • Implement input validation and parameterized queries for XPath operations in custom integrations
  • Review server process execution logs for unexpected OS commands originating from Plesk web processes

Evidence notes

Vendor identification derived from reference_domain_candidate 'Plesk' with low confidence; requires review. Official Plesk support article confirms vulnerability details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44962 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44962

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44962 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44962

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://support.plesk.com/hc/en-us/articles/38633651286679-Vulnerability-CVE-2026-44962-in-Plesk-s-APS-Catalog

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.