CVE-2026-64636

Executive Summary

CVE-2026-64636 is a high-severity SQL injection vulnerability affecting Plesk Obsidian versions up to and including 18.0.80 on both Linux and Windows platforms. An authenticated user with low-privilege access can exploit this flaw to read arbitrary data from the Plesk panel database, potentially exfiltrating sensitive information such as customer credentials, API keys, and configuration data. The vulnerability carries a CVSS score of 7.7 and poses a significant confidentiality risk due to its network-exploitable nature and high potential for lateral data access across the panel's managed hosting environment. At the time of this report, no official patch has been released, and no active exploitation campaigns have been publicly documented.

Technical Analysis

Plesk Obsidian is a widely deployed commercial web hosting control panel that manages domains, email servers, DNS records, databases, and hosting accounts on both Linux and Windows platforms. The panel exposes multiple administrative interfaces, including the main web GUI, command-line tools, and REST APIs, many of which accept user-controlled parameters that are processed through the panel's internal database abstraction layer.

The vulnerability exists in the SQL query construction logic within Plesk Obsidian 18.0.80 and earlier. The flaw resides in an unidentified component that concatenates unvalidated user input directly into SQL statements without adequate parameterization or escaping. While the authentication mechanism correctly validates credentials before allowing access, it does not differentiate between legitimate administrative queries and maliciously crafted parameters once the session is established.

From a code-level perspective, the panel likely constructs SQL statements using string interpolation in a location where parameterized queries were not consistently employed. A typical vulnerable pattern would be:

SELECT * FROM clients WHERE domain_id = '" + request_param + "'"

Rather than the safer parameterized equivalent:

SELECT * FROM clients WHERE domain_id = @domain_id

The attack vector is adjacent to network boundaries (AV:N) but requires prior authentication — hence the Low privilege requirement (PR:L) in the CVSS vector. The vulnerability chain does not impact integrity or availability (I:N, A:N), but the confidentiality impact is rated High (C:H), indicating the potential for complete data disclosure from the panel database.

Given the scope of data stored in the Plesk panel database — including user accounts, encryption keys, database credentials, customer contact information, DNS settings, and subscription metadata — the blast radius is considerable. Any authenticated user with even the lowest panel permissions can leverage this flaw to escalate their data access from their own limited context to the entire panel's database contents, creating a significant privilege escalation in terms of data visibility.

Exploitation Scenarios

The following attack chain demonstrates how an authenticated attacker exploits CVE-2026-64636:

Step 1 — Reconnaissance and Target Identification: The attacker begins by identifying Plesk Obsidian targets via Shodan or Google dorking for panel login pages, using queries such as http.title:"Plesk" or http.title:"Parallels Plesk". Alternatively, the attacker scans the target network for open management ports (TCP 8443, 8880, or 443). The attacker then creates a low-privilege account by signing up for hosting services on the target or obtains credentials through social engineering, credential stuffing (given the weak password policies common in shared hosting), or prior network compromise.

Step 2 — Authentication and Session Establishment: The attacker authenticates to the Plesk panel at https://target:8443/login_up.php using the obtained low-privilege credentials. They confirm successful login by reaching the panel's dashboard endpoint and validating the session cookie is set (typical cookie names include PLESKSESSID).

Step 3 — SQL Injection Trigger: The attacker identifies an injectable parameter by examining the panel's GET/POST endpoints. Likely candidates include the domain search field, subscription filters, or ID-based lookup endpoints. The attacker begins probing with basic payloads to detect the injection point. For instance, they append ' to a numeric parameter to force a database error, or test with a boolean-based payload such as ' AND 1=1-- versus ' AND 1=2-- to observe response differentials. A time-based blind payload like '; WAITFOR DELAY '0:0:5'-- on Microsoft SQL Server or ' AND SLEEP(5)-- on MySQL confirms database engine type.

Step 4 — Payload Execution and Data Exfiltration: Once the injection point and database type are confirmed, the attacker launches UNION-based SQL injection to extract structured data. With MySQL under the panel, a typical payload would be:

' UNION SELECT username, password, salt, NULL FROM mysql.passwords-- -

Or to extract all hosted client credentials:

' UNION SELECT database(), user(), version(), 4, 5-- -

For Windows deployments running Microsoft SQL Server, the attacker would use stacked queries with xp_cmdshell only if system integrity impact were possible, but since the vulnerability is purely read-focused, the attacker instead enumerates system tables:

' UNION SELECT name, master.dbo.fn_varbintohexstr(password_hash), NULL FROM sys.sql_logins--

The attacker scripts the exfiltration using automated tools like sqlmap with --level 5 --risk 2 --dbs to bypass WAF rules, or manually iterates through the database to dump credentials, API tokens, and cleartext encryption keys.

Step 5 — Post-Exploitation Impact: With the extracted database contents, the attacker now holds administrative panel credentials, database passwords for ALL hosted websites, SMTP credentials for email systems, and potentially server-level API keys. The attacker pivots to compromising hosted websites, sending phishing emails through the victim mail servers, or attempting password reuse against the panel's root system account.

Impact Assessment

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N yields a base score of 7.7, classified as High severity. All components of the vector are unfavorable for the defender:

• Attack Vector (AV:N): The flaw is exploitable remotely over the network without requiring physical adjacency.
• Attack Complexity (AC:L): No special conditions are required; the injection parameter is directly reachable.
• Privileges Required (PR:L): Only a low-privileged authenticated account is necessary, dramatically lowering the entry bar.
• User Interaction (UI:N): No victim interaction is needed beyond the initial authentication.
• Scope (S:C): The impact extends beyond the vulnerable component — data leakage affects all panel-managed resources, violating security domain boundaries.

The business impact is substantial for hosting providers and MSPs that run Plesk Obsidian:

1. Customer Data Compromise: Hosting provider customers' credentials, personal information (PII), and intellectual property are all stored or referenced in the panel database.
2. Reputational Damage: A data breach through this vector would expose the hosting provider's failure to isolate client data, triggering mandatory breach notification obligations.
3. Regulatory Compliance Failure: GDPR, HIPAA, PCI-DSS, and other regulations mandate encryption and access control; a single-read SQLi defeats these requirements.
4. Secondary Attacks: Exfiltrated data enables broader attacks against hosted customers, including content injection (into websites), brand abuse via hosted email, and cryptocurrency mining via compromised VPS credentials.
5. Long-Term Trust Erosion: Customers may migrate to alternative hosting providers post-disclosure, causing permanent revenue loss.

The affected environment is any Plesk Obsidian installation up to version 18.0.80, which includes a large portion of the managed hosting market — Plesk is estimated to manage tens of millions of domains worldwide across both shared and VPS hosting environments.

Detection Guidance

Sigma Rule

title: Plesk Obsidian SQL Injection Attempt
id: 5c2d9a44-1f83-4118-9c2b-6541e0bc3f23
status: experimental
description: Detects SQL injection attempts targeting authenticated Plesk Obsidian panel endpoints
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
    c-uri|contains:
      - '/smb/'
      - '/admin/'
      - '/server/'
      - '/login_up.php'
      - '/modules/'
    c-uri|re:
      - '(%27|\'|%22|\"|%3b|;).*(select|union|sleep|waitfor|and|or|--|#)'
      - '(select|union).*(from|information_schema|sys\.)'
  condition: selection
  timeframe: 60s
fields:
  - clientip
  - cs-method
  - c-uri
  - sc-status
  - cs-user-agent
falsepositives:
  - Legitimate panel API calls with URL-encoded special characters
  - Security scanners performing authorized assessments
level: high
tags:
  - attack.t1190
  - cve.2026.64636
  - crime.sql-injection

YARA Rule

rule SQLi_Plesk_Obsidian_CVE_2026_64636
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detect SQL injection payloads targeting Plesk Obsidian panel"
        cve = "CVE-2026-64636"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64636"
    strings:
        $sqli_error_mysql = /You have an error in your SQL syntax|mysql_fetch_array|mysqli_fetch/
        $sqli_error_mssql = /Microsoft.*ODBC SQL Server Driver|Unclosed quotation mark.*in SQL/
        $sqli_union = /UNION\s+SELECT/i
        $sqli_boolean = /AND\s+(1=1|1=2|TRUE|FALSE)/i
        $sqli_time = /SLEEP\s*\(\s*\d+|WAITFOR\s+DELAY\s*'[^']+'/i
        $panel_feature = /(plesk|panel|login_up|smb\/|domain_manage|subscription)/i
        $sqli_comment = /(--|#|\/\*)/i
    condition:
        2 of ($sqli_error_*) and $panel_feature or
        ($sqli_union and $panel_feature and $sqli_comment) or
        ($sqli_boolean and $panel_feature and $sqli_comment) or
        ($sqli_time and $panel_feature)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
  msg:"ET EXPLOIT CVE-2026-64636 Plesk Obsidian SQL Injection Attempt";
  flow:to_server,established;
  content:"|27|"; http_uri;
  content:"union"; http_uri;
  nocase; within:100;
  content:"select"; http_uri;
  nocase; distance:0;
  pcre:"/\/smb\/|\/admin\/|\/server\//Ui";
  classtype:web-application-attack;
  reference:cve,2026-64636;
  sid:202604646;
  rev:1;
  metadata:affected_product Plesk_Obsidian, attack_target Web_Server, deployment DMZ, signature_severity Major;
)

Elastic Detection

POST /_security/rule
{
  "rule": {
    "description": "Elastic EQL rule for SQL injection attempts against Plesk Obsidian panel endpoints",
    "name": "Plesk SQL Injection via EQL",
    "query": """
      sequence by host.id, user.id with maxspan=30s
        [ any where destination.port in (80,443,8443,8880)
            and url.path like "*/smb/*" or url.path like "*/admin/*"
            and (url.query like "*%27*" or url.query like "*'*" or url.query like "*%22*")
        ]
        [ any where network.protocol : "http"
            and transaction.response.status_code >= 200
            and transaction.response.status_code < 500
            and (url.query like "*union*" or url.query like "*select*"
              or url.query like "*sleep*" or url.query like "*waitfor*")
        ]
    """,
    "risk_score": 75,
    "severity": "high",
    "type": "eql",
    "interval": "5m"
  }
}

Splunk SPL Query

index=apache sourcetype=access_combined
  [search index=apache sourcetype=access_combined
    uri_path IN ("/smb/*", "/admin/*", "/server/*", "/login_up.php")
    (uri_query="*union*" OR uri_query="*select*" OR uri_query="*sleep*"
     OR uri_query="*waitfor*" OR uri_query="*--" OR uri_query="*' OR *")
  ]
  OR
index=mysql sourcetype=mysqld
  message="*SQL syntax*" OR message="*Unqualified*" OR message="*error in your SQL*"
  | stats count by src_ip, uri, uri_query, sc_status, user
  | where count >= 5
  | sort - count

Wazuh OSSEC Rule

<group name="webserver_sqli,">
  <rule id="534978" level="12">
    <if_sid>31151</if_sid>
    <regex> /smb/|/admin/|/server/|/login_up\.php </regex>
    <regex> (union.*select|select.*from|sleep|waitfor|--|%27) </regex>
    <decoded_as>web-access</decoded_as>
    <description>CVE-2026-64636: Plesk Obsidian SQL Injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,sqli,plesk,cve-2026-64636,</group>
  </rule>
  <rule id="534979" level="10">
    <if_sid>10064636</if_sid>
    <match>SQL syntax|Unclosed quotation|microsoft.*odbc</match>
    <description>CVE-2026-64636: Successful SQL injection response observed</description>
  </rule>
</group>

Mitigation & Patch Guidance

IMPORTANT: The NVD description clearly states the vulnerability affects "Plesk Obsidian up to 18.0.80," which implies that version 18.0.81 or later constitutes a patched state. However, our patch confidence assessment is 0/4 because no vendor advisory, official changelog, or authoritative patch source has publicly confirmed a fix. Administrators should verify whether their current build is beyond 18.0.80 and monitor Plesk's official channels closely.

1) Immediate Mitigations (until patch is available):

• Restrict Panel Access by IP: Implement network-level firewall rules limiting access to the Plesk panel interface (TCP 8443/8880) to trusted administrative IP ranges and VPN endpoints only. This reduces external attack surface while retaining authenticated access.
• Disable Unused Panel Features: Assess and disable any Plesk extensions, modules, or API endpoints that are not actively used, as each surface area may expose the vulnerable code path.
• Implement Web Application Firewall (WAF) Rules: Deploy ModSecurity or a commercial WAF with rules that block SQL injection patterns targeting panel paths (match the Suricata patterns above).
• Enforce Strong Authentication: Require multi-factor authentication (MFA) for all panel accounts, especially low-privilege ones, to raise the bar for initial access.
• Monitor Authentication Logs: Enable verbose logging and alert on anomalous panel login patterns, including login bursts from a single IP, repeated login failures, or logins from unexpected geographic locations.

2) Patch/Upgrade Steps:

• Check Current Build: Log into the panel and navigate to Tools & Settings → Server Management → Update. Compare the build number against 18.0.81.
• Apply Latest Panel Update: If a build newer than 18.0.80 exists, use the Plesk updater (either via the web UI under Tools & Settings → Updates and Upgrades, or via CLI using plesk installer --select-release-current on Linux, or the Plesk Update Manager on Windows).
• Manual Package Update (Linux): Run apt update && apt upgrade plesk* or the equivalent for your OS package manager, or obtain the latest installer from https://installer.plesk.com/.
• Windows Update: Download and run the latest Plesk setup distribution from the Plesk website or use the built-in update mechanism.
• Verify Patch After Installation: After updating, request a legitimate API call to the affected endpoint using an SQL injection probe and confirm the response no longer contains the vulnerable behavior.

3) Long-Term Hardening:

• Remove Unused Accounts: Audit the panel for dormant low-privilege accounts, especially those created for former customers or staffing divisions, and disable/delete them.
• Principle of Least Privilege: Enforce the minimum required roles and permissions for each panel account. Hosting providers should ensure that customer-level accounts cannot access shared panel features.
• Database Least Privilege: Verify that Plesk's application-level database user has the minimum necessary permissions (no FILE, PROCESS, or SUPER privileges in MySQL/MariaDB) to limit the impact of SQL injection.
• Encrypt Panel Database at Rest: Enable disk-level encryption (LUKS, BitLocker) to protect against offline database theft.
• Regular Security Audits: Subscribe to Plesk security advisories and check the Plesk security mailing list weekly for updates on CVE-2026-64636 and related vulnerabilities.
• Baseline Monitoring: Integrate the Sigma/Suricata/Splunk rules above into your SIEM for continuous detection of SQL injection attempts.

References

1. NVD Entry for CVE-2026-64636 — https://nvd.nist.gov/vuln/detail/CVE-2026-64636 (official CVE record, CVSS vector, and description)
2. Plesk Official Website — https://www.plesk.com/ (release notes and updater access; monitor for version 18.0.81+)
3. Plesk Changelog / Release Notes — https://docs.plesk.com/release-notes/ (check for patched build entries)
4. FIRST.org EPSS — https://www.first.org/epss/ (no score yet assigned for this CVE at time of research)
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/ (attacker technique classification)

Threat Actor Activity: No public evidence of in-the-wild exploitation, ransomware affiliate activity, or nation-state campaigns specific to CVE-2026-64636 was identified as of this report's writing. CISA has not listed this CVE in its Known Exploited Vulnerabilities catalog (KEV). However, given the historical targeting of Plesk control panels by automated botnets and credential-stuffing operations, active exploitation is considered likely once public PoC code or a patch is released.