PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64639 WebPros CVE debrief

The CVE-2026-64639 vulnerability in Plesk's database cloning process allows low-privileged users to execute arbitrary code as the database server administrator. This critical vulnerability has a CVSS score of 9.3 and requires immediate attention. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The vulnerability class is related to incorrect database cloning processes. The likely operational impact is high, given the potential for code execution. Source-confidence limits are based on the CVE Program and NVD assessments. Review context suggests that administrators of Plesk installations, particularly those with low-privileged users, should be aware of this vulnerability and take immediate action to patch their systems.

Vendor
WebPros
Product
Plesk
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-12
Original CVE updated
2026-09-03
Advisory published
2026-08-12
Advisory updated
2026-09-03

Who should care

Administrators of Plesk installations, particularly those with low-privileged users, should be aware of this vulnerability and take immediate action to patch their systems. Affected operators include Plesk administrators and security teams responsible for managing Plesk installations. The vulnerability-management impact is high, as this vulnerability requires immediate attention to prevent potential code execution. Security teams should prioritize patching this vulnerability to prevent potential exploitation.

Technical summary

The CVE-2026-64639 vulnerability in Plesk's database cloning process allows low-privileged users to execute arbitrary code as the database server administrator. This critical vulnerability has a CVSS score of 9.3 and requires immediate attention. The affected product context is Plesk versions from 18.0.52 before 18.0.79.6 and 18.0.80.2. The defensive impact is high, as low-privileged users can exploit this vulnerability to gain elevated privileges. Source-grounded technical framing indicates that the vulnerability is related to the database cloning process, and defenders should focus on securing this process to prevent exploitation.

Defensive priority

Administrators of Plesk installations should prioritize patching this vulnerability to prevent potential code execution.

Recommended defensive actions

  • Apply the latest Plesk updates to ensure the database cloning process is secure.
  • Restrict access to sensitive database operations to prevent low-privileged users from exploiting the vulnerability.
  • Monitor Plesk installations for signs of potential exploitation.

Evidence notes

The CVE-2026-64639 record indicates a critical vulnerability in Plesk's database cloning process, allowing low-privileged users to execute arbitrary code as the database server administrator. Evidence is limited, and further verification is needed to fully understand the vulnerability's impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64639 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64639

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64639 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64639

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://support.plesk.com/hc/en-us/articles/42521305418903-Vulnerability-CVE-2026-64639-Privilege-Escalation-via-Database-Cloning-in-Plesk

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.