CVE-2026-48614
CRITICAL9.9CVSS v3
—CVSS v2
0.33%
EPSS (exploit probability)
CWE-94CWE
Description
An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.
CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected routers (0)
No routers currently mapped to this CVE in our database.