CVE-2026-64637
Received Received - Intake

Improper Privilege Escalation in Plesk XML-RPC API

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-64637
EUVD
EUVD-2026-54563

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
plesk plesk to 18.0.80 (exc)
plesk plesk 18.0.80.1
plesk plesk 18.0.79.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper privilege management issue in Plesk's XML-RPC API. It allows an authenticated reseller to escalate privileges and obtain an administrative session for the root user account.

Detection Guidance

Check the installed Plesk version and build in the Plesk interface under Tools & Settings > Plesk > About Plesk to verify if the server is patched. Ensure the version is 18.0.80.1 or later for Linux and Windows.

Impact Analysis

An attacker with reseller access could gain full root-level control of the server, leading to complete system compromise, data theft, or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA, which mandate strict access controls and data protection measures.

Mitigation Strategies

Update Plesk to the latest build (18.0.80.1 or 18.0.79.5). If updating is not possible, disable OS-level system logins for resellers by setting systemAdmin = off in Panel.ini or disable API access for reseller accounts via service plan permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart