CVE-2026-65647Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://support.plesk.com/hc/en-us/articles/42871001389207-Vulnerability-CVE-2026-65647-in-Plesk-s-Site-Import-and-Migrator-extensions

Weakness type (CWE)

CWE-59

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-08-26); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Patch

150.0%

Disclosure

150.0%

Referenced assets1 URL

By indicator

https://webhosting.today/2026/08/26/plesk-patches-three-flaws-that-start-from-an-ordinary-customer-account/

Classification over time

Date	Total	Labels

2026-08-26	1	Patch1
2026-08-28	1	Disclosure1

Full discourse2 posts

Rıdvan Yağlı@ridvanyagli45d
Disclosure
🚨 Plesk Panel için de son günlerde çok sayıda güvenlik açığı duyuruldu. Birkaçının CVSS skoru 8.x ve 9.x seviyesinde. Öne çıkanlar: • CVE-2026-65642 — Veritabanlarına yetkisiz erişim • CVE-2026-65646 — DNS yönetimi üzerinden arbitrary file read ve yönetici kimlik bilgilerinin açığa çıkması • CVE-2026-65647 — Plesk kullanıcısından root yetkisine yükselme • CVE-2026-67394 — Müşteri/reseller hesabından root yetkisine yükselme ⚠️ Plesk Panel kullananların sistemlerini en kısa sürede güncel sürümlere yükseltmeleri öneriliyor.
Post summary
The post announces multiple high‑CVSS Plesk Panel vulnerabilities, enumerates their effects, and urges prompt patching/upgrading.
0401891.7K
2.4K followersView on X
webhosting.today@WebhostingToday46d
Patch
On Aug 25, @Plesk disclosed 3 flaws, all with fixes. CVE-2026-65647 can let an unprivileged Plesk user execute code as root. A panel update isn’t enough. Check: 🔷 Panel: 18.0.79.8 or 18.0.80.4 🔷 Migrator: 2.36.0 🔷 Site Import: 1.12.1 https://webhosting.today/2026/08/26/plesk-patches-three-flaws-that-start-from-an-ordinary-customer-account/
Post summary
Plesk disclosed CVE-2026-65647, a privilege escalation flaw that lets an unprivileged user run code as root, and provided specific patch versions as mitigation.
0000067
35 followersView on X

Explore more

Back to dashboard