CVE-2026-64639

Executive Summary

CVE-2026-64639 is a privilege-assignment flaw in the database cloning workflow of Plesk, a multi-tenant hosting control panel. Affected builds — 18.0.52 up to but excluding 18.0.79.6, plus 18.0.80.2 — allow an authenticated low-privileged account (a hosting customer or reseller) to execute arbitrary code with the privileges of the database server administrator. The flaw is classified as CWE-266 (Incorrect Privilege Assignment); no public exploit, no in-the-wild exploitation, and no vendor patch have been confirmed by the tracked data, and the CVSS score and vector were not assigned (N/A).

Technical Analysis

The NVD description is sparse and contains no specific function names, API endpoints, file paths, or code-level details. The vulnerability is therefore best analyzed at the class and mechanism level.

Vulnerability class — CWE-266 Incorrect Privilege Assignment. The affected component is the database cloning process in Plesk. In a hosting control panel, database cloning is an administrative routine: a database (or its logical dump, schema, and contents) is copied, typically involving snapshot, dump, restore, or import operations on the underlying database server. The security boundary is the trust separation between a tenant (customer/reseller) and the platform administrator.

The flaw is that this cloning operation runs with, or fails to downgrade from, the privilege level of the database server administrator, rather than being confined to the privileges of the requesting tenant. Since the tenant controls the content of the databases being cloned — including the SQL object definitions stored inside them — any user-influenced database objects that the clone routine causes to be interpreted by the database engine are evaluated in the elevated security context. The result described by the NVD is arbitrary code execution "on behalf of the database server administrator," i.e., the tenant's supplied content is executed as if it originated from the administrator.

Attack surface. The affected deployments are Plesk instances hosting multiple customers and resellers — any environment where a low-privileged panel account has been granted database creation or cloning capabilities. The attack crosses the tenant-to-platform privilege boundary. The database server administrator account (the superuser role of the database engine, and potentially the OS account the database service runs under) is the target privilege level obtained.

Mechanism-level reasoning. Because the description states only that the cloning process is "incorrect," the exact implementation error is unavailable. Plausible class-level explanations consistent with CWE-266 include: invocation of the clone routine using an administrator-role database connection while tenant-controlled parameters or SQL content are processed; failure to re-scope privileges when impersonating a tenant during clone; or execution of stored triggers/procedures/functions contained in the source database under the elevated connection. None of these implementation specifics are confirmed by the data; they are presented as the standard ways a cloning process can stray into CWE-266. Insufficient technical detail is available in the NVD description to identify the precise code path.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-266) and the NVD description's statement that a low-privileged user can execute arbitrary code as the database server administrator.

1. Reconnaissance / target identification. The attacker is an authenticated, legitimate tenant — a Plesk customer or reseller with access to the database management features of their own subscription. They identify the Plesk version (18.0.5x through 18.0.79.5, or 18.0.80.2) via the panel's UI or version disclosure, and determine which database engine family is provisioned for their account. No pre-authentication exposure is involved; the attacker already holds valid panel credentials with low privilege.

2. Triggering the flawed operation. The attacker prepares a database they control so that it contains SQL object definitions that will result in code execution when interpreted by the database engine — for example, stored procedures, triggers, or user-defined functions embedded in the schema. They then invoke the database cloning operation offered to their account. Because of the incorrect privilege assignment in the clone routine, the operation executes using the database server administrator's privileges instead of the tenant's limited role.

3. Payload / execution method. At the vulnerability-class level, the payload is the malicious database content itself: SQL definitions carried in the cloned database that execute at clone/import time. The code runs in the security context of the database server administrator — meaning the attacker's logic obtains the same capabilities as the DB superuser, including cross-database access on that server and, depending on the DB server's OS account configuration, potential file-system or OS-level command execution. Specific SQL primitives and function names are not disclosed in the NVD description and are intentionally not enumerated here.

4. Post-exploitation impact. With database-administrator rights, the attacker can read or modify any database on the same server, including other tenants' data (credentials, personal data, website content), create persistent backdoor accounts or objects, and potentially pivot from the database service to the underlying operating system if the database service runs with elevated OS privileges. From a single low-privileged hosting account, the compromise extends to the shared database tier and, in a consolidated hosting architecture, toward the Plesk control plane.

Impact Assessment

The business impact is a complete breakdown of tenant isolation at the database tier. Blast radius includes: all websites and mailboxes whose data is stored on the affected database server; hosting providers' compliance posture (GDPR, PCI-DSS), since cross-tenant data compromise is a reportable event; and operational integrity, since a DB-admin compromise enables destructive data operations (drop, truncate) against all hosted databases.

Affected systems: Plesk installations running 18.0.52 through 18.0.79.5 and 18.0.80.2. The NVD description does not constrain the flaw to a specific database engine; any engine supported by the Plesk cloning feature on these builds is within scope. The prerequisite is that a low-privileged account has been granted database clone rights.

Severity context: CVSS was not published (N/A), which precludes quantitative risk scoring. The qualitative characteristics — low-privileged attacker, no user interaction, code execution with an administrator identity — are consistent with high confidentiality, integrity, and availability impact. EPSS is 0.00297 (22.3rd percentile), indicating a low-modeled probability of exploitation in the near term. CVE-2026-64639 is NOT in the CISA KEV catalog, and no threat-actor campaigns or exploit-in-the-wild evidence are known.

Detection Guidance

Because no exploit artifacts are public, detections target the observable precursors and consequences of the flaw: (a) database clone/dump/restore/import activity crossing a privilege boundary, (b) privileged SQL object definitions executed in a clone context, and (c) process execution under a database-administrator account originating from a low-privileged parent. Tune all rules to local DB engine naming and restore/backup scheduling, and validate before production deployment.

Sigma Rule

title: Plesk Database Clone Privilege Boundary Crossing (CVE-2026-64639)
id: a3c8e6d1-7f2b-4a9e-8c1d-5b9f0e2a4d7c
status: experimental
description: >
  Detects process creation in which a database-administrator OS account
  (mysql, postgres, pgsql) launches a clone/dump/restore/import operation
  from a low-privileged parent process, consistent with CVE-2026-64639,
  an incorrect privilege assignment in Plesk database cloning (CWE-266).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64639
tags:
  - attack.t1068
  - attack.privilege_escalation
  - cve.2026-64639
logsource:
  category: process_creation
  product: linux
detection:
  selection_db_admin:
    User|endswith:
      - 'mysql'
      - 'postgres'
      - 'pgsql'
  selection_clone_cli:
    CommandLine|contains:
      - 'clone'
      - 'restore'
      - 'import'
      - 'dump'
  selection_low_priv_parent:
    ParentProcessName|endswith:
      - '/apache2'
      - '/nginx'
      - '/httpd'
      - '/php-fpm'
  condition: selection_db_admin and selection_clone_cli and selection_low_priv_parent
  filter:
    CommandLine|contains:
      - 'scheduled-backup'
      - 'cron'
falsepositives:
  - Scheduled database backup/restore jobs started by platform administrators
  - Panel task workers that legitimately run under the database service account
level: high

YARA Rule

rule CVE_2026_64639_Plesk_DBClone_Privileged_SQL
{
  meta:
    author = "Valters IT Threat Intelligence"
    description = "Detects SQL dump content embedding privilege-sensitive object definitions (functions, triggers, procedures, grants) that, when processed by a privileged database clone/import flow, can yield code execution as the database server administrator (CVE-2026-64639, CWE-266)."
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64639"
    date = "2026"
  strings:
    $hdr1 = "MySQL dump" ascii nocase
    $hdr2 = "PostgreSQL database dump" ascii nocase
    $s1 = "CREATE FUNCTION" ascii nocase
    $s2 = "CREATE TRIGGER" ascii nocase
    $s3 = "CREATE PROCEDURE" ascii nocase
    $s4 = "DEFINER=" ascii nocase
    $s5 = "GRANT ALL" ascii nocase
  condition:
    ( $hdr1 or $hdr2 ) and 2 of ($s*)
}

Suricata IDS Rule

Database protocol traffic is the most direct network signal. The rule below alerts on privileged SQL statements issued over the MySQL wire protocol; a Postgres equivalent is included. If DB traffic is TLS-encrypted, these rules are blind and host-based detection must be used.

alert tcp $HOME_NET any -> $HOME_NET 3306 ( \
  msg:"CVE-2026-64639 Suspicious Privileged SQL in Database Clone Context (MySQL CREATE FUNCTION)"; \
  flow:to_server,established; \
  app-layer-protocol:mysql; \
  mysql.query; content:"create"; nocase; content:"function"; nocase; distance:0; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-64639; \
  classtype:attempted-admin; sid:20266463901; rev:1;)

alert tcp $HOME_NET any -> $HOME_NET 5432 ( \
  msg:"CVE-2026-64639 Suspicious Privileged SQL in Database Clone Context (Postgres CREATE FUNCTION)"; \
  flow:to_server,established; \
  app-layer-protocol:postgres; \
  postgres.query; content:"create"; nocase; content:"function"; nocase; distance:0; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-64639; \
  classtype:attempted-admin; sid:20266463902; rev:1;)

Elastic Detection

EQL correlation on endpoint process events: a child process running under a DB-administrator account whose parent process belongs to a different (low-privileged) user, combined with clone/dump/restore/import command-line indicators.

process where event.type == "start"
  and user.name in ("mysql", "postgres", "pgsql")
  and user.name != parent_process.user.name
  and wildcard(process.command_line, "*clone*", "*restore*", "*import*", "*dump*")

An additional precursor EQL query for tenant-side preparation behavior (low-privileged user creating privileged SQL objects):

process where event.type == "start"
  and user.name not in ("mysql", "postgres", "pgsql")
  and (wildcard(process.command_line, "*CREATE FUNCTION*", "*CREATE TRIGGER*",
        "*GRANT ALL*", "*CREATE PROCEDURE*"))

Splunk SPL Query

Process-focused query for privilege-boundary-crossing clone activity:

index=endpoint (sourcetype="WinEventLog:Sysmon" OR sourcetype="sysmon_linux:process") 
  (User="*mysql*" OR User="*postgres*" OR User="*pgsql*") 
  (CommandLine="*clone*" OR CommandLine="*restore*" OR CommandLine="*import*" OR CommandLine="*dump*") 
  ParentUser!="*$User$*"
| stats earliest(_time) latest(_time) count by host, User, ParentUser, CommandLine
| sort - count

Database audit-log query for the tenant-side precursor (privileged SQL objects created by non-admin DB accounts):

index=db (sourcetype="mysql:audit*" OR sourcetype="postgres:log*") 
  ("CREATE FUNCTION" OR "CREATE TRIGGER" OR "CREATE PROCEDURE" OR "GRANT ALL")
| stats count by user, db, query
| where user NOT IN ("root", "postgres", "mysql")

Wazuh OSSEC Rule

The rule below requires an auditd/Sysmon integration that populates user and command fields for executed commands; adjust field names to the local Wazuh decoder output.

<group name="database,privilege_escalation,">
  <rule id="101699" level="12">
    <if_group>database</if_group>
    <field name="user" type="pcre2">^(mysql|postgres|pgsql)$</field>
    <field name="command" type="pcre2">(?i)(clone|restore|dump|import)</field>
    <description>CVE-2026-64639: database clone/restore/import executed under database administrator account from low-privileged context</description>
    <group>attack.privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED per tracked sources (patch confidence 0/4). No vendor fix, advisory, or workaround has been observed by the data sources feeding this report. The NVD version string ("before 18.0.79.6 and 18.0.80.2") implies that corrected builds exist at 18.0.79.6 and in the 18.0.80 line after 18.0.80.2, but this inference must be verified directly with Plesk before acting.

1. Immediate mitigations. Remove or disable database cloning from all customer and reseller service plans where it is not business-critical. Enforce least privilege on database service accounts: run the database server under a dedicated, non-privileged OS user and revoke file-system-level and user-defined-function capabilities that are not required. Enable database audit logging and alert on clone/restore/import operations. Segment database servers from the panel control plane wherever feasible.

2. Patch / upgrade steps. Confirm the availability of fixed builds with the vendor. Upgrade to 18.0.79.6 or the latest 18.0.80.x build if the vendor confirms the fix. Until the patch is verified, treat the feature as untrusted and monitor all clone operations. Do not rely on the inferred version boundary alone, as the tracker has zero patch confidence.

3. Long-term hardening. Apply the principle of least privilege to all role-to-privilege mappings in the panel — customers and resellers should never inherit admin-context operations. Isolate tenant database workloads across separate database instances where compliance requirements demand stronger tenant separation. Test database-clone workflows in a staging environment after each Plesk update. Subscribe to Plesk security advisories and re-assess this CVE when vendor documentation becomes available. Maintain FIM coverage over database configuration and plugin directories to detect tampering.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64639
• CWE-266 — Incorrect Privilege Assignment: https://cwe.mitre.org/data/definitions/266.html
• MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64639 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (EPSS score for this CVE: 0.00297): https://www.first.org/epss/

No known threat-actor campaigns or in-the-wild exploitation evidence was identified for CVE-2026-64639 at the time of writing.