CVE-2026-64637

Full vulnerability record from the local CVENow database.

Description

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

Severity

CRITICAL

CVSS score

9.9 (v3.0)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-07 18:17:20.200000

Last modified

2026-10-24 16:10:00.153000

View original CVE JSON

{
  "id": "CVE-2026-64637",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T18:17:20.200",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account."
    },
    {
      "lang": "es",
      "value": "Gestión inadecuada de privilegios en la API XML-RPC de Plesk anterior a 18.0.80, permite a un revendedor autenticado obtener una sesión administrativa para la cuenta de usuario root."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WebPros",
          "product": "Plesk",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "18.0.80.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T18:24:11.245542Z",
          "id": "CVE-2026-64637",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.plesk.com/hc/en-us/articles/42432168683799",
      "source": "[email protected]"
    }
  ]
}