CVE-2026-87898

Executive Summary

CVE-2026-87898 is an OS command injection vulnerability (CWE-78) in Plesk that allows a remote authenticated user to execute arbitrary operating system commands, resulting in code execution with root privileges. Because successful exploitation yields root-level command execution on the underlying host, any compromised low-privileged Plesk account can escalate to full control of the server and, by extension, every hosted site, mailbox, and database on that node. No public proof-of-concept, exploit code, or Nuclei template is currently available, and no vendor patch has been confirmed, leaving affected deployments exposed with only compensating controls available.

Technical Analysis

The vulnerability is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The NVD description states that OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

At the vulnerability-class level, OS command injection occurs when an application constructs a shell command by concatenating user-controllable input into a string that is subsequently passed to a shell interpreter (for example, through functions that invoke /bin/sh, system(), popen(), or equivalent execution primitives). When input is not properly sanitized, escaped, or passed via argument arrays, shell metacharacters contained in the attacker's input are interpreted by the shell and allow the attacker to append, chain, or substitute commands. The result is execution of attacker-chosen commands under the privileges of the process invoking the shell.

In this CVE the executing process runs with elevated (root) privileges, which is the critical amplifier of impact. The attacker does not need to chain a separate local privilege-escalation step: the injected command inherits the effective user ID of the Plesk component handling the request. This is consistent with Plesk architecture, where administrative components and helper binaries frequently operate as root to manage system services, vhosts, mail, and package operations.

The attack surface is the Plesk management interface reachable over the network (the NVD description specifies remote exploitation). Because the vector requires authentication ("remote authenticated users"), the attacker must already possess valid credentials for some Plesk account. That requirement lowers the barrier asymmetrically: an attacker who has obtained or been granted any low-privileged Plesk login — through credential stuffing, a leaked password, a hosting customer account, or abuse of a reseller seat — can potentially pivot to root on the shared host.

Two aspects of the description should be treated as firm facts and not embellished:

1. The vulnerability class is OS command injection (CWE-78).
2. The post-exploitation privilege level is root.
3. The attacker must be authenticated and remote.

The specific request parameters, endpoints, module names, and the precise shell execution path are not disclosed in the provided intelligence. No vulnerable function names, class names, URL paths, or parameter names are given, and none should be assumed. The precise injection point within Plesk is unknown at this time, and any claim about a particular component would be speculation. Analysts should treat this as a high-severity, unpatched command injection requiring authenticated access and capable of root-level code execution.

CVSS is not available from the source data (NVD does not list a score, FIRST.org has not assigned an EPSS value, and no vector was provided). The vector shown in METADATA is a contextual baseline for an authenticated, network-reachable, root-yielding command injection and is not an authoritative vendor-published score. Analysts should replace it with the official CVSS once NVD publishes one.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-87898. The attack chain below is inferred strictly from the vulnerability class and the NVD description; it deliberately avoids inventing function names, endpoints, or parameters that are not present in the source data.

1. Reconnaissance / target identification. An adversary enumerates internet-facing hosts running Plesk using Shodan/FOFA-style queries (http.title:"Plesk", product:"Plesk", TLS certificate subject fields referencing Plesk). Priority targets are multi-tenant hosting providers, shared hosting nodes, and any Plesk instance exposed to the internet. The attacker determines whether self-registration, reseller accounts, or existing compromised credentials can provide an authenticated session.

2. Authentication and access. The attacker authenticates to the Plesk interface or an authenticated API surface with valid credentials. This could be a legitimate tenant account, a reseller seat, or an account obtained through prior credential theft. Because the vulnerability requires authentication, this step is a prerequisite — the CVE alone does not grant an unauthenticated foothold.

3. Triggering the flaw (class level). The attacker submits input to a Plesk operation that internally builds a shell command from user-supplied data. Because the input is not properly neutralized before reaching a shell, shell metacharacters are interpreted rather than treated as data. The description does not identify the specific field, request, or feature, so the exact trigger cannot be stated with confidence; at the class level, any authenticated function that shells out with insufficient escaping is a candidate.

4. Payload / execution (class level). The attacker supplies a craft that causes the shell to execute attacker-chosen commands in addition to (or instead of) the intended command. The executed command runs with root privileges, as stated in the NVD description. From the attacker's perspective, any arbitrary command can be issued at root context; no further privilege escalation is required.

5. Post-exploitation impact. With root command execution on the Plesk host, the attacker can read and modify all hosted content, extract credentials and private keys for every site and database on the node, alter DNS and mail configuration, install persistence (cron, systemd, web shells), reach the host's network segment, and use the compromised server as a pivot into adjacent infrastructure. In multi-tenant environments this is a full cross-tenant compromise of every customer on that node.

Because the exploit is not public, defenders should treat exploitation as plausible but presently unattended — meaning there is a window to patch or isolate before weaponized code circulates.

Impact Assessment

The impact of CVE-2026-87898 is severe and, in shared-hosting environments, systemic. A single authenticated low-privileged account is sufficient to obtain root command execution, so the effective blast radius is the entire Plesk host and every virtual host, mailbox, database, and customer managed on it.

• Confidentiality: High. Root access permits reading all tenant data, secrets, and cryptographic material on the server.
• Integrity: High. Root permits altering web content, configuration, scheduled tasks, and binaries, enabling persistent backdoors and defacement.
• Availability: High. Root allows destroying data, disabling services, and deploying ransomware on the host.
• Scope: Changed. Exploitation escapes the Plesk application boundary into the underlying operating system and, potentially, the broader network.

Business impact includes mass customer data exposure and loss of trust for hosting providers, possible regulatory and contractual consequences for cross-tenant breaches, and operational cost of full-node rebuilds after compromise. Because the flaw is unpatched, impacted systems carry ongoing risk proportional to how long a foothold exists.

From a CVSS perspective, the contextual vector reflects network exploitability, low attack complexity, low privileges required, no user interaction, changed scope, and high impact across all three confidentiality/integrity/availability metrics. This is not an official vendor score and should be replaced when NVD assigns one.

Detection Guidance

Because the injection point is not publicly documented, detections below target the observable behavior class: a Plesk-facing process (or its child) spawning a shell or unexpected subprocess that ultimately executes attacker-chosen commands as root. These rules are heuristic and must be tuned to the environment; false positives are expected until the exact vulnerable operation is known.

Sigma Rule

title: Potential Plesk OS Command Injection - Suspicious Root Subprocess Spawn
id: 8c1d4f2e-2b77-4a9e-bb41-7f0a9d3c6e10
status: experimental
description: Detects Plesk web/server processes spawning shell or suspicious interpreters as root, consistent with CWE-78 command injection in Plesk.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87898
author: valtersit.com
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026-87898
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/sw-engine'
      - '/sw-engine-cgi'
      - '/plesk'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  selection_user:
    User: 'root'
  condition: selection_parent and selection_child and selection_user
falsepositives:
  - Legitimate Plesk maintenance tasks that invoke shell helpers
  - Administrative tooling and scheduled jobs
level: high

YARA Rule

rule CVE_2026_87898_Plesk_CmdInjection_Markers
{
    meta:
        description = "Heuristic hunting for shell metacharacter payloads and suspicious command execution markers associated with Plesk OS command injection (CWE-78)."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87898"
        cve = "CVE-2026-87898"

    strings:
        $metachar1 = "&&" ascii
        $metachar2 = "||" ascii
        $metachar3 = "`" ascii
        $metachar4 = "$(" ascii
        $metachar5 = ";" ascii
        $shell1 = "/bin/sh" ascii
        $shell2 = "/bin/bash" ascii
        $revshell = "bash -i" ascii nocase
        $revshell2 = "/dev/tcp/" ascii
        $cmd1 = "chmod +s" ascii nocase
        $cmd2 = "chown root" ascii nocase
        $cmd3 = "sudoers" ascii nocase
        $pleskref = "plesk" ascii nocase

    condition:
        uint32(0) != 0x89504E47 and
        (
            (2 of ($metachar*)) and 1 of ($cmd*)
        ) or
        (1 of ($shell*) and 1 of ($revshell*)) or
        ($pleskref and 2 of ($metachar*) and 1 of ($cmd*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-87898 Plesk OS Command Injection Outbound Shell Payload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"plesk"; nocase; http.request_body; content:"&&"; content:"/bin/sh"; nocase; reference:cve,2026-87898; classtype:web-application-attack; sid:202687898; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-87898 Potential Reverse Shell From Plesk Host"; flow:established,to_server; content:"/bin/sh"; nocase; content:"-i"; depth:64; reference:cve,2026-87898; classtype:misc-activity; sid:202687899; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("sw-engine", "sw-engine-cgi", "apache2", "httpd", "nginx", "plesk") and
  process.name in ("sh", "bash", "dash", "python", "perl", "curl", "wget", "nc", "ncat") and
  user.name == "root"

Splunk SPL Query

index=edr OR index=os sourcetype=process_started
| search (parent_process_name IN ("sw-engine","sw-engine-cgi","plesk","apache2","httpd","nginx"))
  (process_name IN ("sh","bash","dash","python","perl","curl","wget","nc","ncat"))
  user="root"
| eval risk="CVE-2026-87898 possible Plesk command injection"
| table _time, host, user, parent_process_name, process_name, process, CommandLine, risk
| sort - _time

Wazuh OSSEC Rule

<group name="plesk,web,command_injection,">
  <rule id="2026878" level="12">
    <if_sid>5500,5501,5502</if_sid>
    <field name="audit.parent_name">sw-engine|sw-engine-cgi|plesk|apache2|httpd|nginx</field>
    <field name="audit.command">sh|bash|dash|python|perl|curl|wget|nc|ncat</field>
    <description>CVE-2026-87898: Possible OS command injection in Plesk - root subprocess spawned by Plesk/web process</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_87898,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version has been confirmed in the provided data. Affected version ranges are unknown. Treat all Plesk instances as potentially affected until the vendor publishes an advisory.

1. Immediate mitigations

   • Restrict management-plane exposure: place the Plesk interface behind a VPN, zero-trust gateway, or IP allow-list. Do not leave it internet-facing where possible.
   • Enforce strong authentication and MFA for all Plesk accounts; remove or disable dormant, shared, and unused accounts and reseller seats.
   • Apply least privilege: audit which accounts can reach administrative or privileged operations and reduce them.
   • Monitor aggressively for the detection patterns above, particularly root-owned shell subprocesses spawned by Plesk/Apache/nginx parents.
   • Segment the Plesk host from critical internal networks to limit pivot potential if root is obtained.

2. Patch / upgrade steps

   • Monitor the official Plesk advisory channel and NVD entry for CVE-2026-87898 for a fixed version.
   • Once a patch is released, test in staging then upgrade the Plesk panel and all components to the fixed release; apply via the standard package manager update path.
   • Re-audit hosts after patching for indicators of prior compromise (unexpected root cron jobs, modified system binaries, new SSH keys, added admin users, outbound connections).
   • If no patch is available, maintain compensating controls above and consider migrating critical workloads off unpatched nodes.

3. Long-term hardening

   • Adopt secure development/configuration practices that avoid shell invocation with user input; where Plesk internals cannot be changed by the operator, keep the platform current and minimize the authenticated attack surface.
   • Implement continuous vulnerability management with authenticated scanning of Plesk instances.
   • Centralize logs (auth, process execution, Plesk audit) into a SIEM with the detections provided, and alert on privilege escalations to root.
   • Enforce network egress filtering to disrupt reverse shells and command-and-control following injection.
   • Maintain an incident-response runbook for full-node compromises in multi-tenant environments.

References

• NVD — CVE-2026-87898: https://nvd.nist.gov/vuln/detail/CVE-2026-87898
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Plesk official security advisories (monitor for CVE-2026-87898): https://www.plesk.com/security/
• CISA Known Exploited Vulnerabilities catalog (check for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87898 at the time of reporting. No exploit-in-the-wild evidence or attributed threat actor campaigns have been identified in the provided data. CISA KEV status: not listed.