[Important] Plesk Security Advisory: Two Critical Vulnerabilities identified, Hotfix Available - Action Required for unmanaged servers

All webhosting, reseller webhosting and managed servers are updated and protected against these vulnerabilities.

Note: all managed, webhosting and reseller hosting servers have been updated and are protected against these vulnerabilities.

We would like to inform you that two security vulnerabilities affecting Plesk have been identified. Hotfixes are now available.

Blind SQL Injection - CVE-2026-64636

• An attacker could extract data from the server database through a read-only SQL injection.

• Affected Versions: Plesk Versions 18.0.51 up to 18.0.79.4

• Fixed Versions: Plesk 18.0.80.1 and Plesk 18.0.79.5

• Support Link: https://support.plesk.com/hc/en-us/articles/42431868205079

Reseller Privilege Escalation to Root - CVE-2026-64637

• An attacker with Reseller-level access could gain Root-level privileges on the server.

• Affected Versions: All Plesk Versions below 18.0.79.5

• Fixed Versions: Plesk 18.0.80.1 and Plesk 18.0.79.5

• Support Link: https://support.plesk.com/hc/en-us/articles/42432168683799

Action Required for unmanaged servers only (not for web/reseller hosting or managed servers):

Update Plesk Now

1. Log into Plesk.

2. Go to tools and settings > Updates and upgrades.

3. Install the latest Plesk updates to update to version 18.0.79.5 or later.

4. Verify the installed version under Tools & Settings > Server Components. 

Mitigation: 

If you are unable to update immediately, you can reduce risk from this issue by either of the following:

• Disabling OS-level system logins for resellers by setting systemAdmin = off under the [login] section of Panel.ini
• Disabling API access for reseller accounts via the relevant service plan permission.

We strongly recommend updating the latest hotfix version as soon as possible.