Loading vulnerability…
Blind SQL Injection in Plesk Obsidian
CVE-2026-64636 is a blind SQL injection vulnerability affecting Plesk Obsidian for Linux and Windows. Affected versions include releases prior to 18.0.80.1 and 18.0.79.5. The flaw allows an authenticated user to inject SQL into backend database queries and infer results through blind techniques, enabling unauthorized retrieval of arbitrary data from the Plesk panel database.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to read arbitrary data stored in the Plesk panel database. Depending on the contents of that database, this may expose sensitive administrative, configuration, account, or service-related information and could facilitate follow-on compromise or privilege abuse within the managed hosting environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting access to authenticated Plesk interfaces to trusted administrators only, enforcing least privilege for panel accounts, monitoring for anomalous database-related behavior through the panel, and limiting access paths to the management interface through network controls. These measures are temporary and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade Plesk Obsidian to a fixed version. The available fixed versions identified are 18.0.80.1 and 18.0.79.5 or later, depending on the update branch in use. Apply the vendor-provided security update across affected Linux and Windows deployments.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.