CVE-2026-64639 Overview
CVE-2026-64639 is a privilege escalation vulnerability in Plesk caused by an incorrect database cloning process. The flaw affects Plesk from version 18.0.52 before 18.0.79.6 and 18.0.80.2. A low-privileged user with customer or reseller access can abuse the cloning workflow to execute arbitrary code in the context of the database server administrator. The issue is tracked under CWE-266: Incorrect Privilege Assignment and is documented in the Plesk Security Advisory CVE-2026-64639.
Critical Impact
A low-privileged customer or reseller can gain database administrator-level code execution on the Plesk host, compromising confidentiality, integrity, and availability of all hosted databases.
Affected Products
- Plesk versions 18.0.52 through 18.0.79.5
- Plesk 18.0.80.0 and 18.0.80.1
- Plesk deployments exposing customer or reseller database cloning functionality
Discovery Timeline
- 2026-08-12 - CVE CVE-2026-64639 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-64639
Vulnerability Analysis
The vulnerability resides in the Plesk database cloning workflow. When a customer or reseller clones a database through the Plesk control panel, the operation runs with privileges belonging to the database server administrator rather than the requesting user. This mismatch between the requester's authorization level and the effective execution context produces a classic privilege confusion condition. An authenticated low-privileged user can steer parts of the cloning operation to execute attacker-controlled logic against the database server. The result is arbitrary code execution on behalf of the database administrator, which typically has full read and write access to every hosted database on the server.
Root Cause
The root cause is incorrect privilege assignment [CWE-266] during database duplication. The cloning routine does not downgrade its execution context to the calling user's privilege scope. Inputs supplied by the customer or reseller are processed under administrator authority, breaking the tenancy boundary Plesk normally enforces between hosting accounts.
Attack Vector
Exploitation requires an authenticated session as a customer or reseller on the target Plesk instance. The attack is delivered over the network through the standard Plesk web interface and does not require user interaction. Because the vulnerable operation executes under database administrator privileges, a successful attack yields code execution beyond the tenant sandbox and enables lateral access to databases owned by other tenants.
No public proof-of-concept code is currently available. Technical details are limited to the Plesk Security Advisory CVE-2026-64639.
Detection Methods for CVE-2026-64639
Indicators of Compromise
- Unexpected database clone operations initiated by customer or reseller accounts, especially outside normal maintenance windows.
- New or modified database objects (stored procedures, triggers, users) created immediately after a clone operation.
- Database server processes spawning shell commands or writing files outside standard data directories.
Detection Strategies
- Correlate Plesk panel audit logs of clone actions with database server logs to spot privilege mismatches between requester and effective user.
- Monitor MySQL or MariaDB error and general query logs for CREATE, GRANT, or LOAD DATA statements originating from clone workflows.
- Alert on process lineage where the database server process spawns interpreters such as sh, bash, perl, or python.
Monitoring Recommendations
- Enable verbose audit logging on the Plesk control panel and forward events to a centralized SIEM for correlation.
- Track file integrity on Plesk web application directories and database configuration files to detect post-exploit persistence.
- Baseline normal cloning activity per tenant and alert on statistical anomalies in volume or timing.
How to Mitigate CVE-2026-64639
Immediate Actions Required
- Upgrade Plesk to version 18.0.79.6, 18.0.80.2, or later as documented in the vendor advisory.
- Audit customer and reseller accounts and disable any that are unused or unrecognized to reduce the attackable authenticated surface.
- Review recent database clone operations and inspect associated databases for unauthorized modifications.
Patch Information
Plesk has released fixed builds 18.0.79.6 and 18.0.80.2. Administrators should apply these updates through the Plesk auto-update mechanism or manually via the Plesk installer. Full remediation guidance is available in the Plesk Security Advisory CVE-2026-64639.
Workarounds
- Restrict access to the Plesk control panel by IP allowlist until patching is complete.
- Temporarily disable the database cloning feature for customer and reseller roles where operationally feasible.
- Rotate database administrator credentials after patching to invalidate any secrets that may have been exposed.
# Configuration example: verify Plesk version and trigger update
plesk version
plesk installer --select-release-current --show-components
plesk installer update
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
