CVE-2026-64637

Executive Summary

CVE-2026-64637 is a critical improper privilege management vulnerability (CWE-269) in the XML-RPC API of Plesk control panel software prior to version 18.0.80. An authenticated reseller can exploit this flaw to obtain an administrative session for the root user account, effectively achieving full administrative control over the Plesk server and all hosted domains. The vulnerability carries a CVSS score of 9.9 (Critical) with a network attack vector, low attack complexity, and no user interaction required, enabling privilege escalation with high confidentiality, integrity, and availability impact that extends across security boundaries (scope changed). All organizations running Plesk versions before 18.0.80 are affected, particularly hosting providers and enterprises that delegate reseller roles.

Technical Analysis

The vulnerability resides in the XML-RPC API implementation of Plesk, a popular web hosting control panel used by managed service providers, hosting companies, and enterprise IT departments. XML-RPC is a remote procedure call protocol that uses XML over HTTP to invoke functions on the server. Plesk exposes a substantial portion of its administrative functionality through this API, including user management, session creation, and privilege assignment.

The root cause is categorized as CWE-269 (Improper Privilege Management), meaning the application fails to properly validate or enforce privilege boundaries when handling certain API operations. Specifically, an authenticated user with reseller-level privileges can craft an XML-RPC request that manipulates session state or privilege attributes in a way that escalates their session to that of the root administrator.

From a code-level perspective, the flaw likely exists in the session management or authentication handling logic within the XML-RPC endpoint handler. When an XML-RPC request is processed, the server may be insufficiently validating the privilege context associated with the caller's session identifier. Instead of properly scoping the reseller's session to reseller-level permissions, a crafted request can cause the server to create or return a session token bound to the root user account. This class of vulnerability typically arises when the application trusts a client-supplied parameter (such as a session ID, user ID, or privilege flag) without verifying it against the authenticated principal's actual entitlements.

The attack surface is the XML-RPC API listener, which is typically accessible over HTTPS on port 8443 (the Plesk control panel port) or on standard web ports when the API is exposed through Apache or nginx. Unlike many control panel vulnerabilities that require administrative access, this flaw only requires reseller credentials — a substantially lower bar, since resellers are often third-party entities (e.g., web design agencies, domain registrars) that may have limited security maturity. This reduces the authentication barrier from "administrator" to "reseller," expanding the population of potential attackers to any compromised or malicious reseller account.

The CVSS vector components are telling: AV:N (Network — exploitable remotely), AC:L (Low complexity — no special conditions or race conditions), PR:L (Low privileges required — only reseller credentials), UI:N (No user interaction), S:C (Scope changed — the impact extends beyond the reseller's security boundary to the root administrator's domain), and C:H/I:H/A:H (High impact on confidentiality, integrity, and availability).

Exploitation Scenarios

Prerequisite: Valid credentials for a reseller account on a Plesk installation running a version prior to 18.0.80.

Step 1 — Reconnaissance/Target Identification: The attacker identifies Plesk instances exposed to the internet. Plesk versions prior to 18.0.80 are broadly deployed across hosting providers and enterprise environments. The attacker determines the XML-RPC API endpoint, which is typically reachable at the server's HTTPS address on port 8443, and confirms the Plesk version by examining the server response headers or the control panel login page (which often announces the product version). Shodan queries such as http.title:"Plesk" or product:"Plesk" port:8443 can be used to surface exposed instances at scale.

Step 2 — Authentication and Session Enumeration: The attacker logs in through the XML-RPC API using the reseller account credentials. Legitimate XML-RPC methods exist for authentication and session creation. The attacker observes the session token (typically a 32-character hexadecimal string) returned by the server upon successful authentication. With a baseline session established, the attacker knows the session format and the API's request structure.

Step 3 — Crafting the Malicious Request: The attacker constructs an XML-RPC request that targets the vulnerable session management function. The exact method is not disclosed in the NVD description, but the CWE classification (Improper Privilege Management) indicates that the attacker likely submits a request that either (a) passes a root user identifier or privilege escalation flag in the session-creation request, or (b) modifies the privilege attributes of the existing reseller session by sending a session-update request with an escalated privilege level. The XML-RPC payload is wrapped in a standard <methodCall> envelope with <params> that contain the manipulated privilege or user-id argument. If the server fails to validate that the caller (reseller) is authorized to request root privileges, it returns a session token bound to the root administrator account.

Step 4 — Privilege Escalation Confirmed: The response from the XML-RPC API contains a session identifier that is authenticated as the root user. The attacker now holds a valid administrative session token. This step may be repeated or verified by invoking an API method that returns the current session's privilege level or user identity; a successful escalation returns "admin" or the root user's identifier rather than the reseller's.

Step 5 — Post-Exploitation Impact: With the administrative session, the attacker can invoke any XML-RPC method available to the root administrator. This includes, but is not limited to: creating new administrator accounts for persistence; reading, modifying, or deleting files on the server through file management APIs; modifying web server and DNS configurations for all hosted domains; extracting database credentials for all hosted applications; disabling security modules (firewalls, Fail2Ban, antivirus); and deploying arbitrary web shells or backdoor scripts within the hosted domains' document roots. Since Plesk typically runs with elevated system privileges, the administrative session may also be leveraged to execute system commands, potentially leading to full operating system compromise. The attacker can pivot to the server's underlying operating system, other services (e.g., MySQL/MariaDB, mail servers), and any other servers managed by the same Plesk installation.

Impact Assessment

Business Impact: This vulnerability represents a complete administrative takeover of the Plesk control panel. For hosting providers, this means all customer data across all hosted domains is compromised. For enterprises running internal hosting infrastructures, the blast radius includes all internal web applications, databases, and associated credentials managed by Plesk. The severity is amplified by the fact that only reseller credentials are required — resellers are often external partners with segmented access, and a compromise of any single reseller account (via phishing, credential reuse, or insider threat) leads to full root-level compromise.

MTTR and Operational Impact: Responding to this vulnerability requires emergency patching of potentially numerous production servers, rotating all administrative and reseller credentials, reviewing all sessions and accounts created during the exposure window, and potentially rebuilding compromised servers. For hosting providers, customer notification obligations may apply under breach disclosure laws.

CVSS Subscores: The CVSS score of 9.9 is driven by: High Confidentiality impact (C:H) — full disclosure of all administrative data, customer data, and credentials; High Integrity impact (I:H) — arbitrary modification of all hosted content, configurations, and system files; High Availability impact (A:H) — the attacker can disrupt services, delete data, or lock out legitimate administrators; Scope Changed (S:C) — the vulnerability in the XML-RPC API (reseller boundary) impacts resources beyond that boundary (root admin domain). The low complexity and lack of user interaction make this easily exploitable by any authenticated reseller.

Affected Systems: All Plesk installations running versions earlier than 18.0.80, including Plesk Obsidian and earlier product generations. The vulnerability is platform-agnostic within Plesk, affecting Linux and Windows hosting environments equally, as the XML-RPC API is a core component of the control panel regardless of the underlying operating system.

Detection Guidance

Sigma Rule

title: Plesk XML-RPC Privilege Escalation Attempt (CVE-2026-64637)
id: 2ab19c6e-6ac7-4973-9f9c-4e4bbf45bc09
status: experimental
description: Detects suspicious XML-RPC requests to Plesk API attempting to obtain administrative session with reseller-level credentials
author: Threat Intel Team
date: 2026/02/15
logsource:
  category: webserver
  product: plesk
  service: access_log
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path:
      - '/xmlrpc*'
      - '/enterprise/control/agent.php*'
  filter_known_methods:
    cs-uri-query|contains:
      - 'method=reseller.get_session'
      - 'method=session.create'
  keywords:
    cs-uri-query|contains:
      - 'admin'
      - 'root'
      - 'privilege'
      - 'escalate'
      - 'role=admin'
  condition: selection and keywords and not filter_known_methods
falsepositives:
  - Legitimate administrative API calls that include the word 'admin' in parameters
level: high

YARA Rule

rule Plesk_XMLRPC_PrivEsc_CVE_2026_64637
{
    meta:
        author = "Threat Intel Team"
        description = "Detects XML-RPC payloads attempting to escalate privileges in Plesk API (CVE-2026-64637)"
        cve = "CVE-2026-64637"
        date = "2026/02/15"
        severity = "critical"
    strings:
        $xml_header = "<methodCall>" nocase
        $xml_body1 = "<methodName>" nocase
        $priv_param1 = "privilege" nocase
        $priv_param2 = "privileges" nocase
        $role_param = "role" nocase
        $root_value = "root" nocase
        $admin_value = "admin" nocase
        $user_id = "user_id" nocase
        $session_param = "session" nocase
        $session_id = "session_id" nocase
    condition:
        $xml_header and $xml_body1 and 3 of ($priv_param*) and 1 of ($root_value, $admin_value) and 1 of ($session_param, $session_id)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Plesk XML-RPC Privilege Escalation Attempt CVE-2026-64637"; flow:to_server,established; content:"POST"; http_method; content:"/xmlrpc"; http_uri; content:"<methodCall>"; within:100; content:"<methodName>"; within:500; pcre:"/role[^\r\n]{0,100}(admin|root)/i"; pcre:"/(privilege|privileges|user_id)[^\r\n]{0,100}(admin|root)/i"; classtype:attempted-admin; sid:202664637; rev:1; metadata:created_at 2026_02_15, cve CVE-2026-64637, attack_target Web_Server, deployment Perimeter;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and destination.port == 8443 and network.protocol == "http" ]
  [ http where http.request.method == "POST" and url.path like "*xmlrpc*"
    and http.request.body.content like "*<methodCall>*"
    and (http.request.body.content like "*privilege*" or http.request.body.content like "*role*")
    and (http.request.body.content like "*admin*" or http.request.body.content like "*root*")
  ]
  [ authentication where event.outcome == "success" and user.name == "admin" and source.ip == preceeding_source_ip ]

Splunk SPL Query

index=web earliest=-7d
  sourcetype=plesk_access
  (uri_path="/xmlrpc" OR uri_path="/enterprise/control/agent.php")
  AND http_method="POST"
  AND (
    uri_query IN ("*role=admin*", "*role=root*", "*privilege=admin*") OR
    request_body IN ("*<methodCall>*", "*privilege*", "*role*", "*session_id*")
  )
  AND NOT user_role="admin"
| stats count by src_ip, user, uri_path, request_body
| where count > 1
| eval severity = "Critical"
| eval cve = "CVE-2026-64637"
| table _time, src_ip, user, user_role, uri_path, request_body, count, severity, cve

Wazuh OSSEC Rule

<group name="plesk,">
  <rule id="100401" level="12">
    <if_sid>31100, 31101</if_sid>
    <match>POST /xmlrpc|POST /enterprise/control/agent.php</match>
    <description>Plesk XML-RPC API access detected - possible CVE-2026-64637 exploitation</description>
    <group>web_application_attack,</group>
  </rule>

  <rule id="100402" level="15" frequency="5" timeframe="120">
    <if_matched_sid>100401</if_matched_sid>
    <match>role=admin|role=root|privilege|user_id=admin|session_id</match>
    <description>CVE-2026-64637: Repeated Plesk XML-RPC privilege escalation attempts from same source</description>
    <group>web_application_attack,access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The NVD description explicitly states the vulnerability affects Plesk "before 18.0.80," which indicates a patched version exists. However, this patch claim has not been independently confirmed by a vendor advisory or secondary source. Refer to your Plesk vendor advisory channels for confirmation and specific patch availability.

1) Immediate Mitigations (until patch is applied): Restrict network access to the XML-RPC API endpoint. On the firewall level, limit access to port 8443 to only authorized administrative IP ranges. Disable the XML-RPC API if it is not required for legitimate business operations — Plesk provides options to disable API access or restrict it to localhost. Audit all reseller accounts and disable inactive or suspicious resellers immediately. Implement additional authentication layers (e.g., IP whitelisting) for reseller accounts that require API access. Monitor and review all successful administrative logins and session creations for anomalies, paying particular attention to sessions created from IP addresses associated with reseller accounts.

2) Patch/Upgrade Steps: Upgrade Plesk to version 18.0.80 or later using the standard Plesk update process. For Linux-based installations, run plesk installer --select-product-id plesk --select-release-current --upgrade-installed-components from the root shell or use the Plesk installer web interface. For Windows-based installations, use the Plesk installer GUI. After the upgrade, verify the installed version with plesk version. Immediately rotate all administrative, reseller, and customer passwords, and invalidate all active API sessions. Review all accounts created in the Plesk database within the exposure window for unauthorized administrative accounts. If exploitation is suspected, perform a full forensic investigation before the session token expires to determine the extent of compromise.

3) Long-Term Hardening: Enforce multi-factor authentication for all reseller and administrative accounts. Implement least-privilege principles for all reseller roles — grant only the specific API operations that business workflows require. Implement centralized logging and alerting for all XML-RPC API access, with particular emphasis on session creation and privilege change events. Subscribe to Plesk security advisories through the Plesk security center. Periodically audit reseller account activity and revoke dormant accounts. Consider segmenting high-value hosting environments from general-purpose hosting to minimize blast radius. Maintain a rollback and incident response plan specifically for control panel compromise scenarios.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64637
• Plesk Security Center (vendor advisory channel): https://www.plesk.com/security/
• Plesk Documentation: https://docs.plesk.com/
• MITRE ATT&CK Technique T1068: https://attack.mitre.org/techniques/T1068/
• CWE-269: https://cwe.mitre.org/data/definitions/269.html

As of this writing, no known threat actor campaigns have been publicly attributed to this vulnerability, no exploit code has been discovered in the wild, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score has not yet been scored by FIRST.org. Organizations should nevertheless treat this vulnerability as an immediate patch priority given the critical CVSS score and the low authentication barrier (reseller account) required for exploitation.