CVE-2026-64637 in Plesk
Summary
by MITRE • 08/07/2026
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical privilege escalation flaw within Plesk's XML-RPC API implementation that undermines the fundamental security boundaries between user roles. The issue stems from inadequate access control validation mechanisms that fail to properly verify the privileges of requesting users before granting administrative capabilities. An authenticated reseller account, which should typically operate with restricted permissions, can exploit this weakness to escalate their privileges and assume the identity of the root administrator. This represents a direct violation of the principle of least privilege and role-based access control concepts that are essential for maintaining secure multi-tenant environments.
The technical flaw manifests in the XML-RPC API's session management and authentication handling processes where the system does not properly validate whether the requesting user possesses sufficient privileges to perform administrative operations. Specifically, when reseller accounts attempt to execute certain administrative functions through the API interface, the underlying validation logic fails to correctly distinguish between legitimate reseller operations and privileged administrative actions. This oversight allows attackers with reseller credentials to bypass normal access controls and obtain root-level session tokens that grant complete system control.
The operational impact of this vulnerability is severe and far-reaching for organizations using Plesk as their hosting control panel solution. Successful exploitation enables attackers to gain full administrative access to the entire Plesk installation, including the ability to modify or delete any user accounts, manipulate website configurations, access sensitive customer data, and potentially compromise the underlying server infrastructure. This privilege escalation can result in complete system compromise, data breaches, and service disruption that affects multiple customers sharing the same hosting environment. The vulnerability is particularly dangerous because it does not require additional authentication factors or complex attack vectors beyond having valid reseller credentials.
Organizations should immediately implement comprehensive mitigation strategies to address this vulnerability. The primary recommendation involves upgrading to Plesk version 18.0.80 or later where the privilege management issues have been resolved through enhanced access control validation. Additionally, administrators should conduct thorough privilege audits to ensure that reseller accounts are not granted unnecessary permissions and implement network segmentation to limit API access to trusted administrative networks. Security monitoring should be enhanced to detect unusual API activity patterns that might indicate exploitation attempts. This vulnerability aligns with CWE-284 which addresses improper access control, and represents a clear violation of ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting. Organizations should also review their incident response procedures to ensure rapid detection and remediation of similar privilege escalation vulnerabilities in other systems.