internet-facing-service-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisory

Privilege Escalation Flaw in Plesk XML-RPC API Exposes Root Admin Sessions

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 7, 2026

WebPros Plesk before version 18.0.80.1 is affected by CVE-2026-64637, an improper privilege management flaw in the XML-RPC API that allows an authenticated reseller to obtain an administrative session for the root user account. The vulnerability is classified as CWE-269 and carries a high-severity CVSS v3 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating low attack complexity and potentially severe impact on confidentiality, integrity, and availability.

A related advisory from CERT-PY flagged the issue in Plesk products, reinforcing the risk to organizations that use the hosting control panel in multi-tenant or reseller environments. Available records indicate the flaw is not currently assessed as exploited in the wild and is not considered automatable, but its ability to let a lower-privileged authenticated user escalate directly to root-level administration makes prompt upgrading to 18.0.80.1 or later a priority.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 16, 2026 – Aug 7, 2026

Aug 7, 20263mo ago
CISA SSVC entry is added for CVE-2026-64637
A CISA SSVC entry was added for CVE-2026-64637, assessing exploitation as none, automatable as no, and technical impact as total. The entry identifies the role as CISA Coordinator and version 2.0.3.
CVE-2026-64637 - Plesk XML-RPC API Privilege Escalation
Aug 7, 20263mo ago
CVE-2026-64637 is newly received for Plesk XML-RPC privilege escalation
CVE-2026-64637 was newly received for an improper privilege management flaw in the WebPros Plesk XML-RPC API affecting versions before 18.0.80.1. The vulnerability allows an authenticated reseller to obtain an administrative session for the root user account.
CVE-2026-64637 - Plesk XML-RPC API Privilege Escalation
Jul 16, 20264mo ago
CERT-PY publishes advisory on Plesk vulnerability
CERT-PY published an advisory titled "Vulnerabilidad en productos Plesk." The provided reference confirms the advisory exists, but the available content does not expose further event details.
Vulnerabilidad en productos Plesk - CERT-PY

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Privilege Escalation in Plesk XML-RPC API (CVE-2026-64637)

Affected products

1 linked

Plesk

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Aug 7, 2026

CVE-2026-64637 - Plesk XML-RPC API Privilege EscalationOpen source ↗

Cert PyAdvisories · Jul 16, 2026

Vulnerabilidad en productos Plesk - CERT-PYOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Privilege Escalation Flaw in Plesk XML-RPC API Exposes Root Admin Sessions

How this story unfolded

CISA SSVC entry is added for CVE-2026-64637

CVE-2026-64637 is newly received for Plesk XML-RPC privilege escalation

CERT-PY publishes advisory on Plesk vulnerability

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

Critical Privilege Escalation Vulnerability in Plesk for Linux

Critical Plesk APS flaw lets authenticated users execute server commands

Privilege Escalation Flaw in Plesk XML-RPC API Exposes Root Admin Sessions

How this story unfolded

CISA SSVC entry is added for CVE-2026-64637

CVE-2026-64637 is newly received for Plesk XML-RPC privilege escalation

CERT-PY publishes advisory on Plesk vulnerability

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Blind SQL Injection in Plesk XML-RPC API Exposes Admin Credentials

Critical Privilege Escalation Vulnerability in Plesk for Linux

Critical Plesk APS flaw lets authenticated users execute server commands