CVE-2026-64637 Overview
CVE-2026-64637 is an improper privilege management vulnerability [CWE-269] in the XML-RPC API of Plesk versions prior to 18.0.80. An authenticated reseller can abuse the API to obtain an administrative session for the root user account. This grants full control of the hosting platform and every customer environment it manages.
The flaw carries a CVSS 3.0 score of 9.9 with a scope change, reflecting that an attacker with limited privileges can compromise resources beyond the vulnerable component. Exploitation requires only reseller-level authentication, which is a common role in shared hosting deployments.
Critical Impact
An authenticated reseller can escalate to root-equivalent administrative access, taking over the Plesk server and all hosted tenants.
Affected Products
- Plesk versions before 18.0.80
- Plesk XML-RPC API component
- Shared hosting environments using Plesk reseller accounts
Discovery Timeline
- 2026-08-07 - CVE-2026-64637 published to the National Vulnerability Database (NVD)
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-64637
Vulnerability Analysis
The vulnerability resides in the XML-RPC API exposed by Plesk for programmatic administration. The API accepts calls from authenticated resellers but fails to enforce role boundaries when handling certain session or user management operations. As a result, a reseller-level caller can request or inherit an administrative session bound to the root account.
Once the reseller holds a root administrative session, they can manage every subscription, customer, database, and file on the server. This effectively converts a tenant-scoped account into a platform-wide administrator. The scope change reflected in the CVSS vector captures this crossing of the tenant isolation boundary.
Root Cause
The root cause is improper privilege management [CWE-269] in the XML-RPC handler. The API relies on authentication to identify the caller but does not correctly validate that the caller's role authorizes the requested operation. Authorization checks that should reject reseller-issued requests for administrative sessions are missing or bypassable.
Attack Vector
Exploitation is performed over the network against the Plesk management interface. The attacker must first hold valid reseller credentials, which are routinely issued in multi-tenant hosting environments. The attacker then issues crafted XML-RPC calls to the Plesk API to obtain an administrative session token or context bound to the root user. Technical specifics of the vulnerable API endpoints are described in the Plesk Support Article.
Detection Methods for CVE-2026-64637
Indicators of Compromise
- XML-RPC requests from reseller accounts to administrative endpoints in /enterprise/control/agent.php or equivalent API paths
- Newly created administrator-level users or API keys that were not provisioned by the platform owner
- Reseller sessions that transition to root-level actions such as global configuration changes or cross-subscription file access
- Unexpected outbound SSH keys, cron jobs, or scheduled tasks added under the root account
Detection Strategies
- Correlate Plesk audit logs with web server access logs to identify reseller accounts invoking administrative XML-RPC methods
- Alert on any privilege transition where a non-admin session executes operations reserved for the admin role
- Baseline normal XML-RPC method usage per reseller and flag deviations, especially calls targeting user, session, or server-wide objects
Monitoring Recommendations
- Forward Plesk panel logs, psa database audit entries, and web server logs to a centralized SIEM for correlation
- Monitor for creation of new administrative accounts, SSH keys under /root/.ssh/, and modifications to /etc/sudoers
- Track authentication events and session issuance from the XML-RPC API, with attention to sessions elevated beyond the caller's role
How to Mitigate CVE-2026-64637
Immediate Actions Required
- Upgrade Plesk to version 18.0.80 or later on all managed servers
- Audit reseller accounts and revoke any that are unused, stale, or attributable to former staff
- Rotate administrative credentials, API keys, and SSH keys after patching to invalidate any tokens obtained pre-patch
- Review recent XML-RPC activity for signs of privilege escalation prior to remediation
Patch Information
Plesk has addressed CVE-2026-64637 in version 18.0.80. Administrators should apply the update through the Plesk auto-update mechanism or the vendor's package repositories. Refer to the Plesk Support Article for release notes and upgrade guidance.
Workarounds
- Restrict network access to the Plesk management interface and XML-RPC endpoints to trusted administrative IP ranges
- Temporarily disable or suspend reseller accounts that do not require API access until the patch is applied
- Enforce multi-factor authentication for all Plesk accounts to reduce the risk of credential-based exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
