CVE-2026-64636 Overview
CVE-2026-64636 is an SQL injection vulnerability affecting Plesk Obsidian versions up to 18.0.80 on both Linux and Windows platforms. An authenticated user can inject SQL statements that read arbitrary data from the panel database. The flaw is categorized under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Exploitation requires only low-privilege authenticated access over the network and does not require user interaction.
Critical Impact
Authenticated attackers can extract arbitrary data from the Plesk panel database, including credentials, configuration values, and hosting metadata belonging to other tenants.
Affected Products
- Plesk Obsidian up to and including version 18.0.80 (Linux)
- Plesk Obsidian up to and including version 18.0.80 (Windows)
Discovery Timeline
- 2026-08-07 - CVE-2026-64636 published to NVD
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-64636
Vulnerability Analysis
The vulnerability resides in a Plesk Obsidian panel endpoint that accepts user-supplied input and concatenates it into an SQL query without adequate sanitization or parameterization. An authenticated user with low privileges submits crafted input that alters the intended query structure. The database engine then executes the injected clauses, returning data the caller is not authorized to view.
Because the scope changes according to the CVSS vector, the injected query can reach data owned by other subscriptions on the same panel. Confidentiality impact is high, while integrity and availability are unaffected in the assessed vector. This makes the flaw a data-disclosure primitive rather than a write or destructive bug.
The Plesk Support Article provides vendor guidance and remediation information for administrators managing affected panels.
Root Cause
The root cause is missing input neutralization on a database query path exposed to authenticated panel users. Query construction relies on string concatenation rather than prepared statements or bound parameters, allowing SQL metacharacters to break out of the intended context.
Attack Vector
The attack is remote and requires network access to the Plesk panel and valid low-privilege credentials. An attacker submits crafted parameters to a vulnerable endpoint and observes returned data or error responses to exfiltrate database contents. Public exploit code is not currently listed for this CVE.
See the Plesk Support Article for vendor-published exploitation context and fix availability.
Detection Methods for CVE-2026-64636
Indicators of Compromise
- Panel access logs containing SQL metacharacters such as ', UNION SELECT, SLEEP(, or comment sequences (--, /*) in request parameters.
- Unexpected database errors or unusually large response payloads from authenticated panel endpoints.
- Authentication events from a single low-privilege account followed by rapid, repetitive parameterized requests indicative of automated injection tooling.
Detection Strategies
- Enable and review Plesk panel access and error logs for anomalous query parameters and repeated 500-class responses.
- Deploy a web application firewall (WAF) with SQL injection signatures in front of the Plesk management interface.
- Correlate authenticated session activity with database query volume to surface accounts that generate abnormal read patterns.
Monitoring Recommendations
- Forward Plesk web server logs and database audit logs to a centralized analytics platform for retention and query.
- Alert on any low-privilege panel account issuing queries that reference tables outside its subscription scope.
- Track failed logins followed by successful sessions from the same source to identify credential-stuffing precursors to exploitation.
How to Mitigate CVE-2026-64636
Immediate Actions Required
- Upgrade Plesk Obsidian to a version later than 18.0.80 as published in the vendor advisory.
- Restrict access to the Plesk panel interface to trusted management networks and VPN ranges.
- Rotate credentials for all low-privilege panel accounts and enforce multi-factor authentication where supported.
Patch Information
Refer to the Plesk Support Article for the fixed build and upgrade instructions. Apply the vendor patch on both Linux and Windows deployments running Plesk Obsidian up to 18.0.80.
Workarounds
- Place a WAF in front of the panel with rules blocking SQL injection payloads until patching is complete.
- Temporarily disable or restrict panel access for low-privilege customer accounts on shared hosting environments where exposure is highest.
- Review database user privileges used by the panel to enforce least privilege and limit the blast radius of a successful injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
