Published September 15, 2026 - Houston, TX. Plesk disclosed CVE-2026-68488 on September 12, 2026, a symlink race condition in the Backup Manager's subscription-content restore function that allows low-privileged users to escalate to root on Linux servers. The flaw is patched in Plesk Obsidian 18.0.62.
Data last verified September 15, 2026 from Plesk security advisory PSA-2026-09, NVD CVE-2026-68488 record, and Plesk update documentation.
Quick Answer
CVE-2026-68488 is a symlink race in Plesk Obsidian Backup Manager that lets low-privilege users escalate to root on Linux. CVSS 7.8 High. Patched in 18.0.62. Update immediately or disable Backup Manager. Last verified: Sep 15, 2026.
At a glance
- CVE: CVE-2026-68488
- Severity: Important (CVSS 7.8 High)
- Component: Backup Manager subscription-content restore
- Vulnerability type: symlink race condition (CWE-363)
- Impact: privilege escalation to root
- Affected: Plesk Obsidian on Linux (all versions before 18.0.62)
- Not affected: Windows installations, Plesk Onyx and earlier
- Patched in: Obsidian 18.0.62
How the symlink race works
The vulnerability allows a low-privileged user to create a symbolic link in the backup restore staging directory that points to a sensitive system file. When the root-level restore process runs, it follows the symlink with root privileges.
The exploit pattern is: (1) low-privileged user initiates a restore operation; (2) during the staging phase, the user creates a symlink in the staging directory pointing to /etc/shadow, /etc/passwd, or another sensitive file; (3) the restore process validates the staged files and begins writing content; (4) during the race window between validation and write, the user swaps the symlink to point to a sensitive location; (5) the restore process writes backup content to the sensitive location with root permissions, granting the user control over the file (Plesk security advisory PSA-2026-09, September 2026; CWE-363 race condition documentation).
CVSS breakdown
CVE-2026-68488 receives a CVSS 3.1 base score of 7.8 (High). The vector and impact metrics drive the high score.
| CVSS metric | Value | Score contribution |
|---|---|---|
| Attack Vector (AV) | Local | Required valid panel credentials |
| Attack Complexity (AC) | Low | Exploit does not require specialized conditions |
| Required Privileges (PR) | Low | Any reseller or customer account |
| User Interaction (UI) | None | No victim interaction required |
| Scope (S) | Changed | Affects components beyond the vulnerable function |
| Confidentiality (C) | High | Full read access to system files |
| Integrity (I) | High | Full write access to system files |
| Availability (A) | High | Can modify or delete critical system files |
Source: NVD CVE-2026-68488 CVSS calculator; Plesk security advisory PSA-2026-09, September 2026.
Affected and unaffected versions
All Plesk Obsidian versions on Linux prior to 18.0.62 are affected. Windows installations and earlier Plesk versions are not affected.
| Plesk version | Platform | Status | Action |
|---|---|---|---|
| Obsidian 18.0.61 and earlier | Linux (all distros) | Affected | Update to 18.0.62 |
| Obsidian 18.0.62 | Linux | Patched | No action |
| Obsidian 18.0.61 and earlier | Windows | Not affected | No action |
| Plesk Onyx 17.x | Linux/Windows | Not affected | No action |
| Plesk 12.x and earlier | Linux/Windows | Not affected | No action |
Source: Plesk security advisory PSA-2026-09, September 2026; Plesk version compatibility matrix, 2026.
Mitigation steps if you can't update immediately
Three mitigations are available until the patch can be applied. Each reduces the attack surface differently.
| Mitigation | Effectiveness | Effort | Notes |
|---|---|---|---|
| Disable Backup Manager entirely | Highest | 5 minutes | Tools & Settings > Backup Manager > Settings |
| Restrict low-privilege users from restore operations | High | 30 minutes | Custom role permissions |
| Monitor /var/log/plesk/backup.log for unusual restores | Medium | Ongoing | Detection-only |
Source: Plesk security advisory PSA-2026-09 mitigation section, September 2026; CrowdStrike Plesk mitigation guide, September 2026.
How to update Plesk safely
Apply the 18.0.62 update via the standard Plesk update mechanism. The update is non-disruptive for most installations.
On Linux: run '/usr/local/psa/admin/sbin/autoinstaller' from the command line, or use the web panel at Tools & Settings > Updates > Update Plesk. The update typically completes in 5-15 minutes with no service interruption. After updating, restart Plesk services with 'systemctl restart sw-cp-server' to ensure all components pick up the patch. For large deployments, consider staging the update on a non-production instance first (Plesk update documentation, September 2026).
Detection signals for exploitation attempts
Three log patterns indicate possible exploitation of CVE-2026-68488. Detection lag is typically hours to days.
| Signal | Log location | Indicator | Detection tooling |
|---|---|---|---|
| Unusual restore targets | /var/log/plesk/backup.log | Restores targeting /etc, /root, /var/lib | Log monitoring (Splunk, ELK) |
| New root-level accounts or SSH keys | /etc/passwd, /root/.ssh/authorized_keys | Unauthorized entries | File integrity monitoring (OSSEC, Tripwire) |
| Suspicious processes spawned by Plesk | auditd, syslog | Backup processes running shell commands | EDR, auditd rules |
Source: Plesk security advisory PSA-2026-09 detection section, September 2026; CrowdStrike Plesk detection rules, September 2026.
Broader implications for the web hosting industry
CVE-2026-68488 is the third Plesk privilege-escalation flaw of 2026 and reflects the challenge of securing shared-hosting environments. Plesk's architecture inherently elevates low-privileged users' impact.
Plesk's design intentionally gives low-privileged reseller and customer accounts significant control over their hosting environment, including backup and restore operations. This design decision creates a large attack surface for privilege-escalation vulnerabilities. Similar patterns have appeared in cPanel/WHM (CVE-2026-51234, fixed March 2026) and DirectAdmin (CVE-2026-44521, fixed May 2026). Web hosting providers should expect one or more critical Plesk vulnerabilities per year and budget patching capacity accordingly (SANS Institute web hosting threat report, 2026; CrowdStrike shared hosting security analysis, 2026).
FAQs
The questions above cover what CVE-2026-68488 is, how the symlink race works, affected versions, severity, patching steps, and mitigation if patching is delayed.
Written by
Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practi… Read moreShow less
Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practical side of building an ed-tech startup.
