CVE-2026-44962

Executive Summary

CVE-2026-44962 is a critical XPath injection vulnerability residing in the APS Application Catalog search functionality of Plesk, a widely deployed web hosting and server management platform. The flaw stems from the application's failure to sanitize user-supplied input before interpolating it into XPath queries. An authenticated, low-privileged user can exploit this to execute arbitrary operating system commands on the underlying server, effectively achieving local privilege escalation to a root-level context. With a CVSS score of 10.0, the vulnerability impacts all Plesk installations using the APS Application Catalog, and no vendor patch is currently available, making it a pressing risk for hosting providers and enterprises managing Plesk servers.

Technical Analysis

The vulnerability is classified under CWE-643, "Improper Neutralization of Data within XPath Expressions," indicating a classic injection flaw specific to XPath query languages. The affected component is the APS Application Catalog search functionality within Plesk. This feature allows users to search for available applications (APS packages) from within the Plesk control panel.

The mechanism of the flaw is as follows:

1. Input Handling: When an authenticated user performs a search in the APS Application Catalog, the search string is passed to a backend processing routine. The application constructs an XPath query to look up application metadata in an XML document that describes available apps.

2. Query Construction: The user-supplied search term is directly concatenated into the XPath expression without any sanitization, encoding, or parameterization. A typical constructed query would resemble //application[name='{user_input}'], where {user_input} is the raw, unescaped string.

3. Injection Vector: An attacker can craft input that breaks out of the string literal context of the XPath query. By injecting XPath operators and functions, they can manipulate the query's logic. More critically, because the backend environment (Plesk) supports the execution of XPath extension functions (e.g., php:function(), eval(), or similar mechanisms), an attacker can invoke an operating system command execution function directly within the XPath expression context.

4. Code Execution: The injected XPath expression is evaluated server-side with the privileges of the Plesk service account, which typically runs with elevated system rights (root on Linux, SYSTEM or Administrator on Windows). This allows the attacker to execute arbitrary OS commands, bypassing all application-level access controls.

Attack Surface: The attack surface is the Plesk control panel's web interface, specifically the APS Application Catalog search page. Authentication is required, but only at the lowest privilege level (e.g., a domain reseller or a customer with limited access). The vulnerability is not restricted to a single OS; both Linux and Windows Plesk deployments are potentially affected.

Root Cause: The absence of input validation and the use of string concatenation for XPath query building are the fundamental programming errors. The lack of parameterized XPath queries (analogous to parameterized SQL statements) and missing input encoding are direct contributors.

Exploitation Scenarios

The following is a step-by-step attack chain, assuming an authenticated low-privileged Plesk user (e.g., a customer with a hosting subscription):

1. Reconnaissance and Target Identification:

   • The attacker identifies a Plesk server. This is typically done via Shodan using dorks like http.title:"Plesk" or by scanning common Plesk ports (8443 for HTTPS, 8880 for HTTP).
   • The attacker confirms the Plesk version by checking the login page or API version endpoints.
   • The attacker authenticates using low-privileged credentials (e.g., obtained via phishing, credential stuffing, or legitimate purchase of a hosting account).

2. Trigger / Weaponization:

   • The attacker navigates to the APS Application Catalog search functionality (e.g., /aps/catalog/search or the "Applications" tab in the Plesk UI).
   • Instead of a normal search term, the attacker inputs a crafted XPath injection payload. For instance:

     ' or php:function('system', 'id') or '
     

     Or more sophisticated variants exploiting XPath 2.0 functions or environment-specific extension functions:

     x' or 1=1 or 'x'='y
     

     Combined with command execution:

     ')] | //application[php:function('system','cat /etc/shadow')] | //application[('
     

   • The payload is designed to close the current string literal, break out of the query context, invoke the command execution function, and then re-balance the query to avoid syntax errors.

3. Payload Execution:

   • The crafted query is submitted. The Plesk backend evaluates the XPath expression, which triggers the embedded OS command.
   • The command executes with the privileges of the Plesk service account. On a typical Linux server, this is often the root user or a user with broad sudo privileges. On Windows, this would be the SYSTEM or the Plesk service account, which has high-level privileges.
   • The output of the command may be relayed back to the attacker through the application's response (error message, search results, or response timing), allowing for blind or semi-blind exploitation if direct output isn't returned.

4. Post-Exploitation Impact:

   • With arbitrary command execution as a high-privilege user, the attacker can:
     • Add new SSH keys to the root user's authorized_keys file for persistent access.
     • Install a web shell or backdoor in the web server's document root (compromising all hosted websites).
     • Dump database credentials and exfiltrate data from all hosted sites.
     • Cripple the server by modifying firewall rules, killing processes, or executing destructive commands.
     • Use the server as a pivot to attack other hosts on the internal network.
   • Since the attacker already has a foothold and the execution is server-side, the escalation to full administrative control is immediate and does not require further privilege escalation steps.

Impact Assessment

The CVSS score of 10.0 reflects the catastrophic nature of this vulnerability:

• Attack Vector: Network (AV:N) — The vulnerability is exploitable over the network via the Plesk web interface. An attacker only needs an authenticated session, which can be obtained through standard web interactions.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are needed. The injection is straightforward and reliable.
• Privileges Required: Low (PR:L) — Only a low-privileged account is required, which can be a standard hosting customer account.
• User Interaction: None (UI:N) — The attack requires no interaction from other users or admins.
• Scope: Changed (S:C) — The impact goes beyond the vulnerable component. Compromise of the vulnerable search functionality leads to compromise of the entire server and all hosted services.
• Confidentiality, Integrity, Availability (C:H/I:H/A:H) — Full impact on all three security pillars. An attacker can read any data (including other customers' databases), modify any files, and cause complete denial of service.

Business Impact:

• Hosting Providers: This is a direct threat to the multi-tenant model. A single low-privileged customer can take over the entire server, compromising the data and services of all other customers on that node. This could lead to massive data breaches, customer churn, legal liabilities (GDPR, CCPA), and severe reputational damage.
• Enterprises: Companies using Plesk to manage internal web servers or development environments face the same outcome — full server compromise. This could lead to lateral movement into broader enterprise networks if the Plesk server is not properly segmented.
• Regulatory Compliance: A compromise resulting in data exfiltration may trigger mandatory breach notification requirements, potentially leading to fines and sanctions.

Blast Radius: The blast radius is the whole server, including all virtual hosts, user data, configs, and any co-located services. Resilience is non-existent since the root cause is a design flaw with no available patch or workaround.

Detection Guidance

Sigma Rule

title: Plesk APS Catalog XPath Injection Attempt
id: 3b9ecae4-2e5c-4f3d-8d7f-2c1a55e92bca
status: experimental
description: Detects generic XPath injection patterns in Plesk APS search requests
author: Valters IT - Threat Intel
logsource:
  category: web_server
  product: apache
  definition: Plesk is typically deployed on Apache/Nginx; IIS for Windows.
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '*/aps/*'
      - '*application*catalog*'
    cs-query|contains:
      - 'or 1=1'
      - 'php:function'
      - 'xpath'
      - ''] |'
      - '//*'
      - 'or count('
      - 'substring('
      - 'concat('
      - 'fn:'
  condition: selection
falsepositives:
  - Legitimate power users searching for complex package names (unlikely)
level: high

YARA Rule

rule Plesk_XPath_Injection_Attempt
{
    meta:
        author = "Valters IT - Threat Intel"
        description = "Detects XPath injection payloads targeting APS Catalog"
        date = "2026-02-XX"
        reference = "CVE-2026-44962"
        severity = "critical"
    strings:
        $xpath1 = "php:function(" ascii wide nocase
        $xpath2 = "or 1=1" ascii wide nocase
        $xpath3 = "]]>" ascii wide nocase
        $xpath4 = "//*" ascii wide nocase
        $xpath5 = "concat(" ascii wide nocase
        $xpath6 = "substring(" ascii wide nocase
        $cmd1 = "system(" ascii wide nocase
        $cmd2 = "exec(" ascii wide nocase
        $cmd3 = "passthru(" ascii wide nocase
    condition:
        any of ($xpath*) and any of ($cmd*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-44962 Plesk APS XPath Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/aps/"; http_uri; pcre:"/(php:function|or\s+1=1|concat\(|substring\(|//\*|\]\]>)/i"; classtype:attempted-admin; sid:202644962; rev:1; priority:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where event.type == "start" and destination.port == 443 and
   http.request.method == "POST" and
   wildcard(http.request.uri, "*/aps/*") and
   string(http.request.body, "php:function") == true]
  [process where event.type == "start" and (
     process.name == "sh" or process.name == "bash" or
     process.name == "cmd.exe" or process.name == "pwsh")]

Splunk SPL Query

index=web sourcetype="access_combined" 
| where match(uri, "(?i)/aps/") 
| rex field=_raw "(?<body>POST /.*HTTP)" 
| where match(body, "(?i)(php:function|or\s+1=1|concat\(|substring\(|//\*|\]\]>)") 
| table _time, src_ip, uri, user, body 
| stats count by src_ip, uri, user
| where count > 5

Wazuh OSSEC Rule

<group name="plesk_xpath_injection,">
  <rule id="100910" level="12">
    <decoded>apache-accesslog</decoded>
    <match>POST /aps/</match>
    <regex>php:function|or\s+1=1|concat\(|substring\(|//\*|\]\]></regex>
    <description>Plesk APS XPath Injection Attempt (CVE-2026-44962)</description>
    <group>attack, exploitation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED. The patch confidence is 0/4, meaning there is no evidence of a fix from any tracked source. No vendor advisory, update, or hotfix is available. Administrators must assume full exposure.

Immediate Mitigations (to implement now):

1. Disable APS Application Catalog: If the APS catalog is not essential to business operations, disable the feature entirely in Plesk configuration. This removes the vulnerable attack surface.
2. Restrict Access via WAF: Deploy a Web Application Firewall (e.g., ModSecurity, Cloudflare) in front of the Plesk interface. Add custom rules to block requests containing XPath metacharacters (', ], |, //, php:function, etc.) in search parameters.
3. Network Segmentation: Place Plesk management interfaces behind a VPN or strict allow-list. Do not expose the control panel (ports 8443, 8880) directly to the internet. Restrict access to trusted IP ranges only.
4. Enable Multi-Factor Authentication (MFA): Enforce MFA for all Plesk user accounts. This raises the bar for an attacker to obtain the low-privileged credentials necessary to exploit the flaw.
5. Disable Unused User Accounts: Audit and remove all dormant or unnecessary user accounts to reduce the attack surface.

Patch/Upgrade Steps:

• Monitor Vendor: Continuously monitor the official Plesk security advisories and changelog page (see References). Subscribe to mailing lists and RSS feeds for immediate notification of a patch.
• Test and Apply: Once a Plesk update addressing CVE-2026-44962 is released, test it in a staging environment replicating production configurations, then roll it out to production services within the maintenance window.
• Verify Integrity: After patching, verify the Plesk version and ensure the APS search functionality uses parameterized XPath queries. Conduct a quick manual test by submitting a benign XPath payload to confirm the injection is blocked.

Long-Term Hardening:

• Leverage OS-Level Protections: Ensure AppArmor/SELinux is enabled and enforcing policies on the Plesk service. This can contain a successful exploit by limiting the commands the Plesk process can execute.
• Principle of Least Privilege: Review the service account under which Plesk runs. On Linux, if it's running as root, consider isolating it into a container or a dedicated VM.
• Proactive Security: Integrate Plesk logs into a SIEM (Splunk, Elastic) for continuous monitoring. Implement automated alerting for any unusual search patterns or command execution attempts.
• Backup and Recovery: Maintain immutable backups of the Plesk server to facilitate rapid recovery in the event of a successful compromise.
• Security Research: Follow the researcher or organization that discovered this vulnerability for additional technical details and potential indicators of compromise.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-44962 (Primary source for vulnerability description and metrics)
2. Plesk Official Security Advisories — https://support.plesk.com/hc/en-us/sections/200808263-Security (Monitor for future patch announcements and vendor fixes)
3. Plesk Community & News — https://www.plesk.com/blog/ (Follow for technical write-ups and analysis)
4. CWE-643 Reference — https://cwe.mitre.org/data/definitions/643.html (Details on XPath injection weakness class)
5. MITRE ATT&CK Enterprise — https://attack.mitre.org/techniques/T1068/ (Privilege escalation technique mapping)

Threat Actor Activity: As of this report, there is no public evidence of active exploitation in the wild, and no exploit code has been released. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the critical severity and the accessibility of Plesk control panels on the internet, it is highly likely that exploit attempts will begin shortly after technical details are more widely disseminated. The lack of a patch makes this a zero-day condition; treat it as an actively dangerous exposure requiring immediate mitigation.