CVE-2026-65646

State: Published
Severity: 9.9 Critical
Published: Aug 26, 2026
Updated: Sep 11, 2026
Reserved: Jul 22, 2026

Description

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Scores

CVSS	Score	Vector	Source
3.0	9.9 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	hackerone

Weaknesses

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected Products

Product	Versions
PleskWebPros	before 18.0.79.11Affected 18.0.80 to before 18.0.80.7Affected

References

https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.