Paper/Archive/CVE-2026-65646

CVE-2026-65646

WebPros Plesk — Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose…

EPSS 0.7%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 53.1.531 × 2010.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Affected

ProductAffectedFixed inSource

Plesk< 18.0.79.1118.0.79.11CNA

Plesk18.0.80 – < 18.0.80.718.0.80.7CNA

Scores by source

hackerone (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality