CVE-2026-67397

⚠ NOTICE: This report is generated from a single sparse NVD description with no vendor advisory, no patch, no CVSS vector, and no published technical details. Where the source data is silent, the report says so explicitly rather than fabricate specifics.

Executive Summary

CVE-2026-67397 describes a path traversal vulnerability in Plesk Obsidian versions 18.0.79.9 and earlier, as well as 18.0.80 through 18.0.80.5. The flaw permits a local user to leverage directory traversal to escalate privileges and execute arbitrary code with root privileges on the host operating system. Because the affected product is a widely deployed web hosting control panel, compromise of the underlying host via this vector could result in full server takeover, affecting all hosted websites, mail services, and customer data. At the time of this writing, no vendor patch, public exploit code, or CISA KEV listing exists; the vulnerability is considered unpatched across all tracked sources.

Technical Analysis

The NVD description for CVE-2026-67397 is sparse but technically definitive on two points. First, the vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — i.e., path traversal). Second, the attack requires local access, meaning the attacker already holds a user account or an unprivileged code-execution primitive on the host, and the impact is arbitrary code execution with root privileges.

Plesk is a commercial web hosting control panel deployed on Linux and Windows servers, commonly running as a set of management daemons, web interfaces (typically on port 8443), and command-line utilities all operating under elevated privileges. In this architecture, a large number of internal file operations — archive extraction, backup/restore, domain configuration updates, SSL certificate handling, log rotation, and update/package management — involve path construction from user-controlled or database-controlled strings. A path traversal bug in any such component allows a local user to supply a relative path with traversal sequences (e.g., ../) that escapes the intended restricted directory. When a privileged service later performs an operation on that path — for example, writing a configuration file, executing a script, or extracting a malicious archive — the operation is performed with the privileges of the vulnerable service, which in a control-panel context is typically root.

The exact vulnerable component, the precise function name, the affected API endpoint, and the specific file path are not disclosed in the NVD description or the CNA title. Without a vendor advisory or CVE details page, we cannot determine whether the flaw lives in the panel’s HTTP request handling, a CLI utility, a cron-run maintenance script, or archive-extraction logic. What is clear from the CWE-22 classification combined with the local-user prerequisite is that the attack surface is an internal file operation performed on an attacker-influenced path without proper canonicalization or containment.

It is also notable that the affected version range spans two separate release streams: 18.0.79.x (and earlier) and the 18.0.80.x line through 18.0.80.5. This breadth across maintenance branches suggests the vulnerable code path was introduced before the 18.0.79 branch and carried forward into 18.0.80, and that the issue was not addressed in the 18.0.80 point releases up to .5.

Exploitation Scenarios

Because no public exploit, PoC, or vendor technical detail is available, the attack chain described below is inferred strictly from the vulnerability class (path traversal with local privilege escalation to root). Specific function names, endpoint paths, and payload syntax are intentionally absent.

1. Reconnaissance / Target Identification: The attacker first establishes any unprivileged foothold on the target host — e.g., a compromised web application running under a limited service account (such as www-data), an abused FTP user account, or a legitimate but low-privileged shell account on a shared hosting server. The attacker enumerates running Plesk processes, installed version (plesk version output), and writable directories or SUID binaries to identify the exact attack surface.

2. Flaw Trigger: With local access, the attacker interacts with a Plesk component — a CLI utility, an internal API call over localhost, or a file operation triggered by a control-panel feature — that accepts a file path or a filename as input. The attacker supplies an argument containing path traversal sequences (e.g., ../../../../etc/cron.d/ in a filename field, or ../../.. in an extraction destination path) to escape a restricted directory intended to house only panel-managed files.

3. Payload / Execution Method: At the vulnerability-class level, this is an arbitrary-file-write or arbitrary-file-operation primitive achieved through traversal. A typical exploitation pattern is to write a cron job, a shell script into a root-executed directory (such as /etc/cron.d/ or a Plesk hook-script directory), or to overwrite a system configuration or executable file. Because the vulnerable Plesk service operates as root, the written file is created with root ownership. A malicious cron entry or a script dropped into a directory traversed by a root-level maintenance process executes with full privileges on the next schedule or trigger.

4. Post-Exploitation Impact: Upon execution of the planted payload, the attacker achieves arbitrary code execution as root and full host compromise. This grants the ability to read all customer data, databases, and mailstores; modify DNS and web configurations; install persistent backdoors (e.g., rootkits, SSH key injection, cron persistence); pivot laterally to other systems reachable from the hosting server; and destroy data. In a multi-tenant hosting environment, this is a cross-tenant compromise: the root shell exposes every website, virtual host, and mail account on the server.

Note: The above is inferred from the CWE-22 classification and the stated local-to-root escalation impact. No public PoC exists, and the precise trigger mechanism and payload delivery path have not been disclosed by the vendor or any researcher.

Impact Assessment

Business Impact: Plesk is a dominant control panel in the shared- and VPS-hosting market. A root-level path traversal affecting a wide version range (18.0.79.9 and earlier, plus 18.0.80 through .5) places a substantial portion of the hosting ecosystem at risk. For managed service providers and hosting companies, exploitation of this CVE would expose customer websites, e-commerce data, credentials, and mail content. For enterprises that self-host web-facing applications on Plesk-managed servers, a successful exploit means full loss of confidentiality, integrity, and availability of that server and any connected internal resources.

Affected Systems: Any server running Plesk Obsidian 18.0.79.x and earlier, or 18.0.80.0 through 18.0.80.5, on Linux or Windows. Both the panel service itself and the hosted tenants are within the immediate blast radius.

Blast Radius and Scope of Damage: Critical. The role of the vulnerable process (root/system) combined with the control-panel position (which manages DNS, mail, web configuration, databases, and file storage) makes the worst-case outcome a full server takeover with multi-tenant data exposure. The lack of a confirmed patch at the time of writing means every affected deployment remains exposed to any local user who identifies the vulnerable path construction.

CVSS / EPSS Scoring: The NVD entry provides no CVSS vector (N/A) and FIRST.org has not yet released an EPSS score. Given the qualitative factors — local attack vector mitigates remote exposure — a reasonable estimate, if the scoring were complete, would land in the high range (likely 7.0–8.0) due to the root-privilege outcome and the confidentiality/availability impact across multiple tenants. Until an official vector is published, however, no authoritative score exists.

Detection Guidance

The following rules are constructed to detect the pre-exploitation reconnaissance steps (probing of Plesk paths, local execution of Plesk binaries) and the post-exploitation artifacts (unusual root-level cron modifications, abnormal Plesk process behavior) that would accompany exploitation of a local path traversal. Detection of the traversal trigger itself over the network is unreliable because the attack is local; host-based monitoring is the primary detection layer.

Sigma Rule

title: Plesk Local Path Traversal - Privilege Escalation Activity
id: 5d8a4e6c-1f22-4f90-9a5b-4c3e2a1d0b99
status: experimental
description: Detects execution of Plesk management binaries with path traversal arguments indicative of CVE-2026-67397 exploitation or reconnaissance.
date: 2026/01/15
author: Valters IT Threat Intel Team
logsource:
    category: process_creation
    product: linux
detection:
    selection_plesk_bin:
        Image|endswith:
            - '/usr/local/psa/bin/*'
            - '/opt/psa/bin/*'
            - '/usr/bin/plesk'
    selection_traversal:
        CommandLine|contains:
            - '../'
            - '..%2f'
            - '..\\'
    selection_sensitive_paths:
        CommandLine|contains:
            - '/etc/'
            - '/root/'
            - '/usr/lib'
            - 'cron.d'
    condition: selection_plesk_bin and selection_traversal and selection_sensitive_paths
falsepositives:
    - Legitimate Plesk admin operations referencing paths outside panel directories (rare)
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.67397

YARA Rule

rule CVE_2026_67397_Plesk_Path_Traversal_Artifacts
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects log artifacts, payload scripts, or downloaded content containing Plesk path traversal patterns referencing CVE-2026-67397"
        date = "2026-01-15"
        cve = "CVE-2026-67397"
        severity = "high"
    strings:
        $s1 = "../../" ascii
        $s2 = "..%2f" ascii nocase
        $s3 = "/etc/cron.d/" ascii
        $s4 = "/usr/local/psa/" ascii
        $s5 = "plesk" ascii nocase
        $s6 = "var/log/plesk" ascii nocase
    condition:
        uint16(0) == 0x0A23 and     // shebang / shell script preamble
        filesize < 200KB and
        (($s1 or $s2) and $s5) and
        (any of ($s3, $s4, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67397 - Plesk Path Traversal Probe via Local Web Interface (8443)";
    flow:to_server;
    content:"../"; http_uri;
    pcre:"/(\.\.\/|\.\.%2f|\.\.%5c){2,}/Ui";
    content:"plesk"; http_uri; nocase;
    http_port:8443;
    classtype:attempted-admin;
    reference:cve,2026-67397;
    sid:202600001; rev:1;)

Note: This Suricata rule only detects remote HTTP-based probes against the Plesk web interface (port 8443). Since the attack vector is local (file-system-level), network detection has limited coverage. Host-based logs constitute the primary detection source.

Elastic Detection

// Detect Plesk binary execution with traversal patterns in arguments
process where
  event.action == "exec" and
  process.executable : ("/usr/local/psa/bin/*", "/opt/psa/bin/*", "/usr/bin/plesk") and
  process.command_line : ("*../*", "*..%2f*", "*..\\*") and
  process.command_line : ("*/etc/*", "*/root/*", "*cron.d*")

Splunk SPL Query

index=linux_secure OR index=linux_syslog sourcetype=linux_audit
| search (process_exec OR execve) AND target_process=*plesk*
| regex target_command="(\.\./|\.\.%2f|\.\.\\)"
| regex target_command="(/etc/|/root/|cron\.d)"
| table _time, host, user, target_process, target_command, parent_process
| sort - _time

Wazuh OSSEC Rule

<group name="plesk,local_exp,privilege_escalation,">
  <rule id="100305" level="12">
    <if_sid>510</if_sid>  <!-- base execve rule -->
    <field name="file">/usr/local/psa/bin/|/usr/bin/plesk</field>
    <regex>\.\./|\.\.%2f|\.\.\\</regex>
    <description>CVE-2026-67397: Potential Plesk path traversal for privilege escalation - command contained traversal sequences.</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Note: The Sigma, Suricata, Elastic, and Splunk rules above are generic patterns tuned to the Sparse description available. Since no public exploit or detailed technical writeup exists, detection confidence is moderate; these rules must be vetted against normal Plesk administrative traffic. The Wazuh rule references a generic base rule ID (510) that may require adjustment to match the host's native audit configuration.

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, hotfix, or patched version (e.g., 18.0.80.6 or later) has been identified across NVD, the Plesk changelog, or community security trackers. Until Plesk releases a patched build, the following actions are recommended:

1. Immediate Mitigations (no patch available):

   • Audit all local user accounts and web-application service accounts on Plesk-managed servers. Disable or restrict any unnecessary shell accounts, FTP accounts, or service accounts unless they are strictly required.
   • Remove write access to directories that a lower-privileged user could use to stage payloads — e.g., verify that /tmp, /var/tmp, and web-root directories are not writable by panel daemons beyond legitimate needs.
   • Restrict execution of Plesk CLI binaries (/usr/local/psa/bin/*) via sudo policies, ensuring only administrators can invoke them with arbitrary path arguments.
   • Enable and review auditing (e.g., auditd on Linux) for execve events of Plesk binaries and for any writes to /etc/cron.d/, /etc/cron.*, and system rc directories.
   • If feasible in a staging environment, fuzz the Plesk file-operation surfaces (archive import, backup restore, SSL cert upload) with traversal strings to determine reachable attack paths and prioritize monitoring.

2. Patch / Upgrade Steps:

   • Monitor the official Plesk release notes and security advisories daily for a patched version (expected to be 18.0.80.6 or later, and a backport to the 18.0.79 branch).
   • Test the patched release in a staging environment before applying to production hosting servers.
   • Apply the patch to both Linux and Windows Plesk installations, since the description does not restrict the flaw to one operating system.

3. Long-Term Hardening:

   • Implement a least-privilege model: web applications should not run as root or with panel-administrator rights; isolate tenants via containerization or per-VM virtualization.
   • Restrict outbound egress from hosting servers to hamper post-exploitation activities (e.g., C2 callbacks, lateral movement).
   • Deploy a file-integrity monitoring (FIM) tool over Plesk’s configuration directories, /etc/cron.d/, and the panel’s internal data store to detect unauthorized modifications.
   • Maintain an up-to-date inventory of all Plesk installations and their exact versions to identify scope when the patch arrives.
   • Monitor CISA KEV and vendor advisories for escalation of this CVE to known-exploited status, which would require immediate emergency patching.

References

1. NVD Entry — CVE-2026-67397: https://nvd.nist.gov/vuln/detail/CVE-2026-67397 — The authoritative CVE record; NVD description is the only source of technical detail referenced in this report.
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html — Classification reference; explains the underlying flaw mechanism and common exploitation patterns.
3. MITRE ATT&CK — T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/ — Technique mapping for the local privilege escalation impact.
4. Plesk Official Changelog / Release Notes (To be monitored): https://docs.plesk.com/release-notes/ — Placeholder; no advisory referencing CVE-2026-67397 has been published at the time of writing. This page should be monitored for a patch announcement.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Monitored; CVE-2026-67397 is NOT currently listed (as of report date).

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None. No public exploit code, PoC, Nuclei template, or reports of in-the-wild exploitation of this CVE exist across tracked sources at the time of this report. Given the absence of a patch and the simplicity of the vulnerability class, organizations should treat this as a potential near-term weaponization target and prioritize the mitigations listed above.