Vulnerability record · CVE-2026-68489 · published 14 September 2026

CVE-2026-68489: Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote…

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

8.7 CVSS 4.0 High EPSS 0.67% · top 49.8% CWE-96 · CWE-96 Awaiting Analysis

8.7CVSS 4.0 base score

0.67%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

1References

18 Sep 2026Last modified by NVD

Description

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

Link	Tags
https://support.plesk.com/hc/en-us/articles/43473204617239

Track CVE-2026-68489 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-86218N-able N-central pre-auth remote code execution via static code injectionN-central contains a static code injection flaw (CWE-96) that allows remote code execution before authentication. The record states the issue affects…KEVEPSS 13%analysed6 Sep 2026

Source: NIST National Vulnerability Database (record CVE-2026-68489), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.