Loading vulnerability…
Privilege Escalation in Plesk XML-RPC API
CVE-2026-64637 is an improper privilege management vulnerability in the XML-RPC API of WebPros Plesk affecting versions before 18.0.80.1. The flaw allows an authenticated reseller account to improperly obtain an administrative session associated with the root user account. This represents a privilege escalation condition in which authorization boundaries between reseller-level access and full administrative access are not correctly enforced within the XML-RPC API.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a reseller-level authenticated attacker to escalate privileges to the highest administrative context on the affected Plesk instance by obtaining a root administrative session. This can result in total compromise of the management plane, including unauthorized access to sensitive data, modification of configuration and hosted resources, creation or alteration of accounts, and actions that could affect service availability. The reported CVSS vector indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the XML-RPC API to only trusted administrative networks, restrict or disable reseller access where operationally feasible, and closely monitor reseller-initiated administrative actions and session creation for anomalous behavior. These measures are temporary risk-reduction steps and do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade WebPros Plesk to version 18.0.80.1 or later. Apply the vendor-provided fix addressing improper privilege management in the XML-RPC API and verify that all Plesk installations are updated beyond the affected versions.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.