Resolved CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerability

[devnull]

Server operating system version

Ubuntu 24

Plesk version and microupdate number

Plesk Obsidian 18.0.77 Update #3

See https://www.cve.org/CVERecord?id=CVE-2026-9256 . I saw that Cpanel already fixed the issue https://support.cpanel.net/hc/en-us...ea-nginx-v1-31-1-Security-Release-May-22-2026

When does Plesk?

 

[Sebahat.hadzhi]

@devnull , thank you for the question. A hotfix is in progress, and the update will be released for Plesk Obsidian 18.0.77 and 18.0.78. The ETA is 27-28th of May.

 

[Franchino]

Plesk Obsidian 18.0.78 Update 2

Changes in Third-Party Components

Updated nginx and the sw-cp-server service to version 1.30.2.

https://docs.plesk.com/release-notes/obsidian/change-log/#plesk-18078-mu2

 

[Daveo]

Also, for 18.0.77 users...

Plesk Obsidian 18.0.77 Update 4​

27 May 2026

Changes in Third-Party Components​

Linux​

• Updated nginx and the sw-cp-server service to version 1.30.2.

https://docs.plesk.com/release-notes/obsidian/change-log/?18077#plesk-18077-mu4