CVE-2026-64636

HIGH

CVE: CVE-2026-64636 - An SQL injection vulnerability in Plesk Obsidian up to 18Sign in to save

CVSS

7.7

CVSS v3.1

EPSS

0.2%

Exploit Prediction Score

Published

August 7, 2026

Exploitability

EPSS probability 0.2%

Description

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Weaknesses

CWE-89

Affected Packages

No package data available.

Aliases

CVE-2026-64636

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://support.plesk.com/hc/en-us/articles/42431868205079