What is the CVSS score of EUVD-2026-54562?

EUVD-2026-54562 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Plesk Obsidian are affected by EUVD-2026-54562?

Plesk Obsidian (through version 18.0.80) contains a SQL injection vulnerability enabling authenticated panel users to read arbitrary customer data, credentials, and configurations from the shared…. A patch is available.

How to fix or mitigate EUVD-2026-54562?

Within 24 hours, identify all Plesk Obsidian installations running version 18.0.80 or earlier via asset inventory and immediately implement database credential restrictions, limiting access to minimal required privileges with detailed SQL query logging enabled. Within 7 days, establish database-level access controls, audit and disable non-essential panel user accounts, and document personnel with database access capabilities. Within 30 days, establish weekly monitoring of Plesk security advisories for patch release, develop an upgrade plan to versions above 18.0.80 once released, and deploy additional authentication or network segmentation controls for panel access as interim measures.

Plesk Obsidian EUVD-2026-54562

| CVE-2026-64636 HIGH

SQL Injection (CWE-89)

2026-08-07 support@hackerone.com

GHSA-j4xg-65wf-c7hr

SQLi Microsoft

7.7

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable panel requires low-privilege auth (PR:L); read-only SQLi justifies C:H with I:N and A:N; database boundary crossing warrants scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 07, 2026 - 19:02 EUVD

Analysis Generated

Aug 07, 2026 - 18:31 vuln.today

CVE Published

Aug 07, 2026 - 18:17 cve.org

HIGH 7.7

DescriptionCVE.org

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

AnalysisAI

SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Plesk Obsidian is a commercial web hosting control panel deployed on both Linux and Windows, managing domains, email accounts, databases, SSL certificates, and multi-tenant customer data through a web-based interface. The vulnerability is a classic SQL injection flaw (consistent with CWE-89, though CWE is listed as N/A in the source data) in the panel's backend query handling, where user-controlled input is insufficiently sanitized before being incorporated into database queries. The Plesk panel database typically contains highly sensitive information across all hosted tenants, including account credentials, DNS records, email settings, and billing configurations. The CVSS vector's scope change (S:C) captures the architectural reality that exploiting the web application layer yields unauthorized read access to the database tier, which sits outside the application's normal authorization boundary. The vulnerability was reported via HackerOne (support@hackerone.com), suggesting coordinated disclosure.

RemediationAI

Upgrade Plesk Obsidian beyond version 18.0.80 per the vendor advisory at https://support.plesk.com/hc/en-us/articles/42431868205079. The exact patched release version is not stated in the available input data and has not been independently confirmed - consult the vendor advisory directly for the specific target version. If immediate patching is not feasible, implement IP allowlisting on the Plesk panel access port (typically TCP 8443) to restrict who can reach the vulnerable endpoint, noting this reduces attack surface but does not remediate the underlying flaw. Audit all panel user accounts and remove or disable any low-privilege accounts that are no longer needed, as exploitation requires authenticated access. Rotate Plesk database credentials after patching if unauthorized access cannot be ruled out.