According to the CVE records published on 10 September 2026 UTC (11 September, 12:24 am Perth; HackerOne CNA), WebPros Plesk has two critical Backup Manager flaws. CVE-2026-68487 is a path traversal (CWE-36) in Plesk's Backup Manager that lets an authenticated customer write arbitrary files as root. CVE-2026-68488 is a time-of-check time-of-use (TOCTOU) race condition leading to insecure symlink following, which allows local privilege escalation to root through arbitrary file or directory ownership takeover.

The records rate both CVSS 3.0 9.9 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and list Plesk 18.0.80.6 and earlier and 18.0.79.10 and earlier as affected; CISA's enrichment of the records lists no known exploitation. Plesk's own security articles, linked here, return 403 to Cyberstack. (source: CVE records)

Correction (27 Oct 2026): removed details that came only from Plesk's articles and Cyber Security News, neither readable to Cyberstack: the Linux-only scope and the line that Plesk for Windows is not affected, the unsigned-backup-header and subscription-restore mechanics, the fixed versions 18.0.80.7 and 18.0.79.11, the no-interim-mitigation line and the shared-hosting priority note; the Cyber Security News link is removed. The card date has moved from 10 to 11 September 2026, the Perth date of the CVE records (10 September, 16:24 UTC; 11 September, 12:24 am Perth (AWST)). (source: CVE.org)