CVE-2026-65646

Severity: critical (CVSS 9.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-11
Weakness: CWE-74

Description

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Affected products

WebPros Plesk: before 18.0.79.11; from 18.0.80 before 18.0.80.7 — fixed in 18.0.79.11, 18.0.80.7

How to fix

Upgrade to a fixed version: WebPros Plesk 18.0.79.11, 18.0.80.7. Check the vendor advisory for mitigations.

References

https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality

Get alerted when CVE-2026-65646 or the next vulnerability affects your stack