CVE-2026-65642: High severity Plesk Plesk vulnerability
Published Aug 26, 2026
·Updated
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.
Affected Software
2 affected components
Plesk Plesk>18.0.0<=18.0.79.7
Plesk Plesk>=18.0.80<=18.0.80.3
Event History
Aug 26, 2026
CVE Published
via MITRE·09:21 PM
Data Sourced
via MITRE·09:21 PM
DescriptionWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be a remote authenticated user of Plesk. The issue affects access to other customers' databases through the database management interface.
2
Which Plesk versions are affected?
Affected versions are Plesk 18.0.79.7 and earlier, plus versions 18.0.80 through 18.0.80.3.
3
What could an attacker do?
A successful attacker could read and modify databases belonging to other customers.