Multiple vulnerabilities affecting the Plesk platform

Plesk is a widely used hosting control panel for web server, domain, database and email administration. This solution is affected by several vulnerabilities labeled as follows: CVE-2026-65642: This vulnerability arises from an insecure direct reference to an object within the database management interface. Exploitation of this vulnerability would allow an authenticated attacker to bypass client account isolation and gain unauthorized access to databases. It is classified high with a severity score of 8.6 according to CVSS v4.0. CVE-2026-65646: This vulnerability results from incorrect neutralization of special elements (injection, CWE-74) within the DNS zone management functionality. Exploitation of this vulnerability would allow an attacker with appropriate access rights to read arbitrary files on the affected system. It is classified high with a severity score of 8.7 according to CVSS v4.0. CVE-2026-65647: This vulnerability results from incorrect resolution of symbolic links before accessing a file. Exploitation of this vulnerability would allow an authenticated attacker to execute arbitrary code with root privileges on the affected system. It is classified high with a severity score of 8.7 according to CVSS v4.0. CVE-2026-67394: This vulnerability would allow a malicious actor with shell access to elevate their privileges and gain full root access on the server. It is classified critical with a severity score of 9.0 according to CVSS v4.0.

• Plesk for Linux and Windows: versions 18.0.79.7 and earlier, 18.0.80 to 18.0.80.3 inclusive;

RECOMMENDED ACTIONS:

• Update to version 18.0.79.8 or 18.0.80.4 (or later);