CVE-2026-64637

No fix known EPSS <1%CVSS 9.9

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

Published 2026-08-07 · CVE record · OSV

Products: WebPros Plesk