ThreatCluster

Critical Privilege Escalation Vulnerability in Plesk Requires Immediate Action

First seen 14 Aug 2026, 06:35 UTC • •72

Article Content

1 / 4

Browse articles

ThreatCluster •August 15, 2026 at 05:39 UTC

•CVE-2026-64639 allows low-privileged users to escalate privileges on Plesk servers.
•The vulnerability has a high CVSS score of 9.3, indicating critical risk.
•Immediate patching is recommended as there is currently no known exploitation.

A severe privilege escalation vulnerability, CVE-2026-64639, has been identified in Plesk versions prior to 18.0.79.6 and 18.0.80.2. This flaw allows low-privileged users to execute arbitrary code as the database server administrator, significantly impacting multi-tenant hosting environments. The vulnerability was published on August 12, 2026, and has a CVSS score of 9.3, indicating a high severity level. While there is currently no evidence of exploitation in the wild, the Centre for Cybersecurity Belgium has issued an urgent recommendation for affected organizations to apply patches immediately. The vulnerability affects users who can clone or copy databases, potentially allowing them to breach intended security boundaries. Organizations are advised to enhance monitoring and detection capabilities to identify any suspicious activity related to this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 77d ago How this analysis works

Timeline

2026-08-12

CVE-2026-64639 published

A privilege escalation vulnerability in Plesk was disclosed, affecting multiple versions.

www.tenable.com

2026-08-13

CCB issues urgent patch recommendation

The Centre for Cybersecurity Belgium advised immediate patching for vulnerable Plesk installations.

More articles in this cluster (3)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Vulnerability (1)

CVE-2026-64639

Weakness (1)

CWE-269 - Improper Privilege Management

Technique (1)

T1068 - Exploitation for Privilege Escalation

Affected Platform (1)

Plesk

Relationships

CVE-2026-64639 targets Plesk
T1068 - Exploitation for Privilege Escalation targets Plesk
CVE-2026-64639 related to CWE-269 - Improper Privilege Management

Following this threat?

Track CVE-2026-64639 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

North Korean Hackers Steal $6.3 Billion from Binance in Record Crypto Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, reported a massive security breach resulting in the theft of approximately $6.3 billion across ten blockchains. The attack is attributed to North Korea's TraderTraitor hacking group, which gained access via a compromised DevOps engineer's…

Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…