CVE 2026 64639

www.tenable.com • August 14, 2026

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.

Published : 2026-08-12

Vector : CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Privilege Escalation Vulnerability in Plesk Requires Immediate Action A severe privilege escalation vulnerability, CVE-2026-64639, has been identified in Plesk versions prior to 18.0.79.6 and 18.0.80.2. This flaw allows low-privileged users to execute arbitrary code as the database server administrator, significantly impacting multi-tenant hosting environments. The vulnerability was published on August 12, 2026, and has a CVSS score of 9.3, indicating a high severity level. While there is currently no evidence of exploitation in the wild, the Centre for Cybersecurity Belgium has issued an urgent recommendation for affected organizations to apply patches immediately. The vulnerability affects users who can clone or copy databases, potentially allowing them to breach intended security boundaries. Organizations are advised to enhance monitoring and detection capabilities to identify any suspicious activity related to this vulnerability. 2 sources 72

Extracted Entities

CVE 2026 64639

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

IP Addresses (2)

Platforms (1)