internet-facing-service-vulnerabilitywidely-deployed-product-advisorydata-exfiltration-method

Blind SQL Injection in Plesk Obsidian Exposes Server Database Data

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 10, 2026

WebPros disclosed CVE-2026-64636, a blind SQL injection vulnerability in Plesk Obsidian affecting both Linux and Windows deployments. The flaw impacts Plesk for Linux versions 18.0.51 through 18.0.80 and Plesk for Windows 18.0.80 and earlier; WebPros said successful exploitation could let an attacker extract data from the server database through a read-only SQL injection. The issue is tracked in WebPros security advisory AV26-790 and was responsibly disclosed by Aziz Knani.

WebPros released fixes in Plesk Obsidian versions 18.0.80.1 and 18.0.79.5 and urged administrators to apply the latest hotfix build immediately. As temporary mitigations, the company advised restricting reseller system logins and reseller API access until patching is complete. The advisory was also circulated through the Canadian Centre for Cyber Security, underscoring the need for prompt remediation across exposed hosting environments.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Aug 7, 2026 – Aug 10, 2026

Aug 10, 20263mo ago
WebPros advisory AV26-790 issued for CVE-2026-64636
A WebPros security advisory identified as AV26-790 was dated for CVE-2026-64636, confirming that Plesk Obsidian versions prior to 18.0.80.1 and 18.0.79.5 are affected by the blind SQL injection vulnerability. The notice referenced the advisory via the Canadian Centre for Cyber Security.
WebPros security advisory (AV26-790) - Malware News - Malware Analysis, News and Indicators
Aug 7, 20263mo ago
Plesk publishes CVE-2026-64636 advisory and fixes
Plesk published guidance for CVE-2026-64636, stating that Linux versions 18.0.51 through 18.0.80 and Windows 18.0.80 and earlier are affected, and that fixes are available in versions 18.0.80.1 and 18.0.79.5. It also urged administrators to update immediately and provided temporary mitigations such as disabling reseller system logins and reseller API access.
CVE-2026-64636 Vulnerability in Plesk: blind SQL injection - Plesk
Reported Aug 7, 20263mo ago
Aziz Knani responsibly discloses blind SQL injection in Plesk
Plesk said CVE-2026-64636, a blind SQL injection vulnerability affecting Plesk for Linux and Windows, was responsibly disclosed by Aziz Knani. The flaw could allow read-only extraction of data from the server database.
CVE-2026-64636 Vulnerability in Plesk: blind SQL injection - Plesk

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Blind SQL Injection in Plesk Obsidian (CVE-2026-64636)

Affected products

1 linked

Plesk Obsidian

Organizations

1 linked

Plesk

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Malware NewsNews · Aug 10, 2026

WebPros security advisory (AV26-790) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Support PleskNews · Aug 7, 2026

CVE-2026-64636 Vulnerability in Plesk: blind SQL injection - PleskOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

internet-facing-service-vulnerabilitywidely-deployed-product-advisorydata-exfiltration-method

Blind SQL Injection in Plesk Obsidian Exposes Server Database Data

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 10, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Aug 7, 2026 – Aug 10, 2026

Aug 10, 20263mo ago
WebPros advisory AV26-790 issued for CVE-2026-64636
A WebPros security advisory identified as AV26-790 was dated for CVE-2026-64636, confirming that Plesk Obsidian versions prior to 18.0.80.1 and 18.0.79.5 are affected by the blind SQL injection vulnerability. The notice referenced the advisory via the Canadian Centre for Cyber Security.
WebPros security advisory (AV26-790) - Malware News - Malware Analysis, News and Indicators
Aug 7, 20263mo ago
Plesk publishes CVE-2026-64636 advisory and fixes
Plesk published guidance for CVE-2026-64636, stating that Linux versions 18.0.51 through 18.0.80 and Windows 18.0.80 and earlier are affected, and that fixes are available in versions 18.0.80.1 and 18.0.79.5. It also urged administrators to update immediately and provided temporary mitigations such as disabling reseller system logins and reseller API access.
CVE-2026-64636 Vulnerability in Plesk: blind SQL injection - Plesk
Reported Aug 7, 20263mo ago
Aziz Knani responsibly discloses blind SQL injection in Plesk
Plesk said CVE-2026-64636, a blind SQL injection vulnerability affecting Plesk for Linux and Windows, was responsibly disclosed by Aziz Knani. The flaw could allow read-only extraction of data from the server database.
CVE-2026-64636 Vulnerability in Plesk: blind SQL injection - Plesk

Linked entities