Loading story…
WebPros disclosed CVE-2026-64636, a blind SQL injection vulnerability in Plesk Obsidian affecting both Linux and Windows deployments. The flaw impacts Plesk for Linux versions 18.0.51 through 18.0.80 and Plesk for Windows 18.0.80 and earlier; WebPros said successful exploitation could let an attacker extract data from the server database through a read-only SQL injection. The issue is tracked in WebPros security advisory AV26-790 and was responsibly disclosed by Aziz Knani.
WebPros released fixes in Plesk Obsidian versions 18.0.80.1 and 18.0.79.5 and urged administrators to apply the latest hotfix build immediately. As temporary mitigations, the company advised restricting reseller system logins and reseller API access until patching is complete. The advisory was also circulated through the Canadian Centre for Cyber Security, underscoring the need for prompt remediation across exposed hosting environments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A WebPros security advisory identified as AV26-790 was dated for CVE-2026-64636, confirming that Plesk Obsidian versions prior to 18.0.80.1 and 18.0.79.5 are affected by the blind SQL injection vulnerability. The notice referenced the advisory via the Canadian Centre for Cyber Security.
Plesk published guidance for CVE-2026-64636, stating that Linux versions 18.0.51 through 18.0.80 and Windows 18.0.80 and earlier are affected, and that fixes are available in versions 18.0.80.1 and 18.0.79.5. It also urged administrators to update immediately and provided temporary mitigations such as disabling reseller system logins and reseller API access.
Plesk said CVE-2026-64636, a blind SQL injection vulnerability affecting Plesk for Linux and Windows, was responsibly disclosed by Aziz Knani. The flaw could allow read-only extraction of data from the server database.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WebPros disclosed **CVE-2026-58046**, a blind SQL injection flaw in the **Plesk XML-RPC API** that affects all Plesk versions earlier than **18.0.79.4**. The vulnerability allows a remote authenticated user with low privileges, including customer- or reseller-level access, to query the Plesk database and read arbitrary contents. Plesk warned that exposed data can include administrator credentials, creating a path to **full server compromise**. The issue is classified as **`CWE-89`** and carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`**, reflecting high impact across confidentiality, integrity, and availability. Plesk has patched the flaw in **18.0.79.4** and urged administrators to update immediately; for systems that cannot be upgraded at once, the vendor recommended mitigations in `panel.ini` to enforce strict API protocol version validation or to restrict XML API access to trusted IP addresses only. The Canadian Centre for Cyber Security also issued advisory **AV26-761**, directing organizations to apply the vendor guidance.
Jul 30, 2026
Plesk disclosed and patched **CVE-2026-44962**, a critical privilege-escalation flaw in **Plesk on Linux** that allows a low-privileged authenticated user to execute arbitrary operating system commands on affected servers. The bug stems from an **XPath injection** issue in the **APS Application Catalog** search function, where unsanitized input is inserted into XPath queries, enabling remote exploitation without user interaction. The vulnerability carries a **CVSS 10.0** rating and can lead to administrative access and full compromise of server resources, with particular risk for shared hosting and other multi-tenant deployments. Plesk released fixes in versions **18.0.76.2** and **18.0.75.1**, and advised administrators to update immediately. For systems that cannot yet be patched, the company said the **APS subsystem** should be disabled through the `panel.ini` configuration file and management components restarted. The flaw was responsibly disclosed by **Georgii Shutiaev**, and reports said there was no public evidence of active exploitation at the time of publication, though defenders were urged to review access controls and monitor for suspicious command execution.
Jun 29, 2026
WebPros Plesk before version **18.0.80.1** is affected by **CVE-2026-64637**, an improper privilege management flaw in the **XML-RPC API** that allows an authenticated reseller to obtain an administrative session for the **root** user account. The vulnerability is classified as **CWE-269** and carries a high-severity **CVSS v3** vector of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, indicating low attack complexity and potentially severe impact on confidentiality, integrity, and availability. A related advisory from **CERT-PY** flagged the issue in Plesk products, reinforcing the risk to organizations that use the hosting control panel in multi-tenant or reseller environments. Available records indicate the flaw is not currently assessed as exploited in the wild and is not considered automatable, but its ability to let a lower-privileged authenticated user escalate directly to root-level administration makes prompt upgrading to **18.0.80.1** or later a priority.
Aug 8, 2026