Critical severity9.9NVD Advisory· Published Sep 10, 2026· Updated Sep 10, 2026
CVE-2026-68488
CVE-2026-68488
Description
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
2- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · Sep 21, 2026
- Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to ServersCyber Security News · Sep 13, 2026