Plesk Authentication Bypass Leading to Root Privilege Escalation (CVE-2026-64637)

Vulnerability Overview Vulnerability ID: CVE-2026-64637 Vulnerability Type: Authentication bypass leading to privilege escalation Description: A security vulnerability was discovered in Plesk that allows for authentication bypass, resulting in privilege escalation from a Reseller-level account to root. Impact Scope Affected Product Versions: - Plesk for Linux: 18.0.80 and earlier - Plesk for Windows: 18.0.80 and earlier Remediation Patch Versions: - Plesk for Linux: 18.0.80.1 and 18.0.79.5 - Plesk for Windows: 18.0.80.1 and 18.0.79.5 How to Verify if the Server is Patched You can confirm the installed Plesk version and build via the Plesk interface. Log in to Plesk. Additional Information Author: Pablo Alvarez Last Updated: 1 day ago Other Page Content Related Articles: - CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API - CVE-2026-64636: Vulnerability in Plesk: blind SQL injection - Alt-php-fpm fails to start on CloudLinux: unable to bind listening socket for address '127.0.0.1:9000': Address already in use (98) - Vulnerability CVE-2026-48614 in Plesk XML API - Does CVE-2026-42167 affect ProFTPD in Plesk? - What does Imunify notifications do in Plesk? - PHP settings do not apply on a domain when CapFS is enabled in CloudLinux - [CVE-2025-64431] Security vulnerability in domain creation mechanism allows Plesk users to execute arbitrary code on behalf of root - Generating CSR certificate under AlmaLinux 9 Advertisement SocialBee for Plesk: Keep your social media feeds fresh and engage with smart scheduling. Start your free trial today. Navigation Bar Help: How to help us? Submit Request Log In Footer No specific footer content.

Goal Reached Thanks to every supporter — we hit 100%!

Plesk Authentication Bypass Leading to Root Privilege Escalation (CVE-2026-64637)