CVE Catalog
CVE-2026-64637
CriticalCVSS 9.9Summary
Improper privilege management in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user account.
Risk Assessment
An authenticated reseller can gain full administrative privileges, potentially leading to unauthorized access and control over the server.
Recommendation
Upgrade Plesk to version 18.0.80 or later, which includes the fix.
Original NVD description (English source)
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.