CVE Catalog
CVE-2026-64637
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk0.23%
14th percentile - higher than 14% of all known CVEs
Summary
Improper privilege management in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user account.
Risk Assessment
An authenticated reseller can gain full administrative privileges, potentially leading to unauthorized access and control over the server.
Recommendation
Upgrade Plesk to version 18.0.80 or later, which includes the fix.
Original NVD description (English source)
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.