EUVD-2026-66764
GHSA-g8q6-5f8r-jhhf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged Plesk account
-
DeliveryAccess DNS zone management feature
-
ExploitInject unsanitized special elements
-
ExecutionRead arbitrary local files / trigger privileged action
-
ImpactEscalate to full host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires an authenticated Plesk account (PR:L) - any valid panel login such as a customer or reseller - with access to the DNS zone management functionality, which is the specific feature carrying the injection flaw. No user interaction and no elevated privileges are needed beyond that foothold, and it is exploitable over the network against affected versions (<18.0.79.8 and 18.0.80-18.0.80.3). Limiting factors: the attacker must hold or obtain a working account and be able to reach the DNS management interface, so deployments that do not expose DNS editing to untrusted tenants or that gate the panel behind network controls are meaningfully harder to attack. |
| Impact | The CVSS 3.0 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), driven by network reachability, low complexity, and a scope change from a low-privileged account to full host compromise. However, corroborating exploitation signals are weak: EPSS is only 0.29% (21st percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and there is no KEV listing or public POC - so this is a genuinely high-impact issue but not currently under active or automatable exploitation. The one meaningful gating factor is PR:L: an attacker must already hold a valid (even low-privileged) Plesk account, which in multi-tenant hosting is a realistic threat model since resellers and customers routinely have panel logins. Given Plesk's role as a host-level control plane and the total technical impact, any operator running an affected build - even a mid-sized hosting shop - should prioritize patching quickly despite the low EPSS, because the barrier (a foothold account) is low in shared-hosting contexts. Note the 'Information Disclosure' tag understates the issue, which also includes privilege escalation and integrity/availability impact. |
| Exploit ScenarioDerived | A reseller or customer with a legitimate low-privileged Plesk login submits crafted input into a DNS zone record field that injects special elements the DNS management code fails to neutralize. The injection is used to read a sensitive server file (such as a configuration or credential file) and then to perform a privileged action, escalating from a tenant account to control of the host. No public POC is currently available, but the low attack complexity means exploitation would be straightforward once the injection point is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 11, 2026
Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inject special elements into the DNS zone management functionality to read arbitrary files on the server and escalate their privileges. Because the CVSS scope is changed (S:C), a low-privileged panel user can break out of their intended boundary to compromise the underlying host with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS is low (0.29%) with SSVC exploitation status 'none', indicating no observed exploitation yet.
Earlier versions of this analysis (1)
Injection via improper neutralization of special elements in Plesk's DNS zone management functionality enables remote authenticated users to read arbitrary local files and escalate privileges on the hosting server. Affecting all tracked versions of WebPros Plesk (CPE wildcard), this flaw combines information disclosure and privilege escalation into a single exploitable path, making it a high-impact post-authentication threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability warrant prompt remediation.
RemediationAI
Vendor-released patch: upgrade to Plesk 18.0.79.8 (for the 18.0.79.x and earlier line) or 18.0.80.4 (for the 18.0.80.x line) or later, as described in the Plesk support advisory (https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality). Apply through the Plesk updater or your provider's maintenance channel and verify the running micro-update version afterward. If immediate patching is not possible, reduce exposure by restricting who holds panel accounts and by limiting or disabling tenant access to the DNS zone management feature (this removes self-service DNS editing for customers/resellers, a functional trade-off), and by placing the Plesk administrative interface behind IP allowlisting or a VPN to shrink the pool of attackers who can reach an authenticated session. These are compensating controls only; the reliable fix is the version upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Plesk is a widely used commercial web-hosting control panel from WebPros (cpe:2.3:a:webpros:plesk) that manages web, mail, and DNS services for hosting providers and their tenants. The root cause is CWE-74 (improper neutralization of special elements, an injection class): user-supplied input to the DNS zone management feature is not properly sanitized before being passed into a sensitive operation, allowing the input to be interpreted as command/control elements rather than data. This lets a logged-in panel user break out of the intended DNS-record context to read local files (e.g., configuration or credential files) and pivot into higher-privileged operations, which aligns with the scope-change (S:C) reflected in the CVSS vector.
Know when Plesk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable panel feature exploitable by any low-privileged account (PR:L) with no interaction; injection breaks tenant scope (S:C) yielding full host confidentiality, integrity, and availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
4DescriptionCVE.org
Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.
Executive ViewAI
WebPros Plesk hosting control panel versions 18.0.79.7 and earlier, plus versions 18.0.80 through 18.0.80.3, allow low-privileged panel users (resellers, limited account holders) to read sensitive files and escalate to full server compromise. Organizations running Plesk-based hosting infrastructure should prioritize patching: a single compromised low-privilege account can give an attacker complete access to all hosted customers and data on that server.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. Rated medi
A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via th
Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to e
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inj
Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise
Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-
Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper
OS command injection in Plesk allows any authenticated low-privilege panel account - customer, reseller, or subscription
Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.
Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level
Authenticated Plesk panel users can escalate to root on Plesk 18.0 (Obsidian) servers by exploiting incorrect access con
Exploit-DB