Plesk EUVD-2026-54563

Exploitation requires an authenticated reseller-level account (PR:L in the CVSS vector) on a Plesk instance older than 18.0.80, and network reachability to the XML-RPC API endpoint. The specific product feature abused is the XML-RPC API's authorization handling for reseller sessions. Limiting factors: the attacker cannot be fully anonymous - a valid reseller credential is mandatory - which confines realistic risk to shared/reseller hosting deployments or to environments where a reseller credential could be phished, purchased, or otherwise acquired; single-tenant Plesk servers with no untrusted resellers face substantially lower practical risk.

All available signals point to a genuine high priority in multi-tenant contexts, though with an important gating factor. The CVSS 3.0 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - network reachable, low complexity, only low privileges required, no user interaction, and a scope change reflecting the reseller-to-root privilege crossing with full confidentiality, integrity, and availability impact. The critical limiter is PR:L: the attacker must already hold a valid, authenticated reseller account, so this is not remote-unauthenticated. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC signals means no confirmed active exploitation. The high CVSS is well-justified by the impact (full server compromise), but real-world exposure is concentrated in shared/reseller hosting deployments where untrusted or semi-trusted parties legitimately hold reseller accounts.

An attacker who has purchased or otherwise obtained a legitimate reseller account on a shared Plesk server issues crafted XML-RPC API calls that improperly grant an administrative session for the root user. With that session the attacker gains full control of the panel and the underlying server, allowing them to read all tenants' data, modify configurations, and disrupt hosted services. No public exploit code has been identified at time of analysis, and low attack complexity means a working technique would be straightforward to reuse once known.