Improper Privilege Management in Plesk's XML-RPC API

CVE-2026-64637

What is CVE-2026-64637?

An improper privilege management issue exists in the XML-RPC API of Plesk prior to version 18.0.80, allowing authenticated resellers to gain unauthorized access to administrative functionalities. This vulnerability poses significant risks to server integrity and confidentiality, as it enables resellers to initiate an administrative session with the root user account, potentially compromising sensitive data and overall system security.

References