What is the CVSS score of CVE-2026-64637?

CVE-2026-64637 has a CVSS 3.0 base score of 9.9 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Plesk are affected by CVE-2026-64637?

Plesk control panels prior to version 18.0.80 contain a critical privilege escalation vulnerability in the XML-RPC API that allows authenticated reseller accounts to elevate directly to root-level…. A patch is available.

How to fix or mitigate CVE-2026-64637?

Within 24 hours, complete an inventory of all Plesk deployments to identify systems running versions before 18.0.80, immediately disable or restrict XML-RPC API access for all reseller-tier accounts to whitelisted IP addresses only, and enforce multi-factor authentication on all reseller accounts. Within 7 days, audit administrative access logs for unauthorized privilege escalation attempts, implement network segmentation between the hosting control plane and production customer systems, and document all current delegated reseller permissions. Within 30 days, establish weekly monitoring of Plesk security advisories for patch availability, prepare upgrade procedures to Plesk 18.0.80 or newer, and design a least-privilege reseller permission model to limit future escalation surface.

Plesk CVE-2026-64637

EUVD-2026-54563 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-07 support@hackerone.com

GHSA-27h3-c9gv-83jx

Privilege Escalation

9.9

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable XML-RPC API with low complexity and only a reseller account (PR:L); the reseller-to-root crossing is a scope change (S:C) yielding full C/I/A server compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 07, 2026 - 19:02 EUVD

Analysis Generated

Aug 07, 2026 - 18:30 vuln.today

CVE Published

Aug 07, 2026 - 18:17 cve.org

CRITICAL 9.9

DescriptionCVE.org

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

AnalysisAI

Privilege escalation in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller-level account to obtain a fully administrative session for the root user, effectively taking over the entire hosting server. The flaw is a CWE-269 improper privilege management issue reported through HackerOne; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Because a reseller can cross the privilege boundary to root with low attack complexity, this is a high-impact server-takeover vector in multi-tenant hosting environments.

Technical ContextAI

Plesk is a widely used commercial web hosting control panel that manages web servers, mail, DNS, and customer accounts across multiple privilege tiers (administrator/root, resellers, and their customers). The vulnerability lives in the XML-RPC API, Plesk's programmatic management interface, which is intended to enforce role-based authorization on each call. CWE-269 (Improper Privilege Management) indicates the API fails to correctly constrain a reseller's authorization scope, permitting it to negotiate or assume an administrative session token bound to the root account. The root cause is a broken trust boundary between the reseller role and the server-wide administrator role rather than a memory-safety or injection defect.

RemediationAI

Vendor-released patch: 18.0.80 - upgrade Plesk to 18.0.80 or later, which is the primary and recommended fix; consult the vendor advisory at https://support.plesk.com/hc/en-us/articles/42432168683799 for exact micro-update instructions. Where immediate patching is not possible, reduce exposure by restricting or auditing which parties hold reseller accounts and by limiting network access to the XML-RPC API endpoint (restrict it to trusted management IPs via firewall or the Plesk firewall module), accepting that this may break legitimate automation or reseller tooling that relies on remote API calls. Additionally, monitor for anomalous administrative session creation and reseller-initiated API activity as a detection compensating control until the upgrade is applied.