CVE-2026-65642

Executive Summary

CVE-2026-65642 is an insecure direct object reference (IDOR) vulnerability affecting Plesk control panel versions 18.0.79.7 and earlier, as well as versions 18.0.80 through 18.0.80.3. The flaw permits remote authenticated users — including low-privilege customers with standard reseller or client accounts — to read and modify database objects belonging to other customers hosted on the same Plesk server.

The vulnerability is particularly severe because Plesk is a multi-tenant control panel; a single compromised or malicious customer account can directly impact the confidentiality and integrity of other tenants' databases, potentially leading to data exfiltration, unauthorized modification, or destruction. As of the writing of this report, no patch is available, and the vendor has not acknowledged the vulnerability publicly, leaving all affected installations exposed.

Technical Analysis

Insecure Direct Object Reference (IDOR) is a class of access control vulnerability in which an application exposes a reference to an internal implementation object — such as a database identifier, record key, or file handle — without first verifying that the requesting user is authorized to access that object. CWE-639 formally describes this condition.

In the context of Plesk, the control panel exposes management functionality to authenticated users for administering their own hosting resources, including databases. The vulnerability stems from the application's failure to sufficiently validate ownership of database resources before performing operations. An authenticated user who crafts a request referencing a database object identifier that does not belong to their account may successfully read or modify that database, provided the request reaches a server-side handler that trusts the user-supplied reference without performing an authorization check.

The NVD description specifies two distinct affected version branches:

• 18.0.79.7 and earlier — the entire legacy branch of the 18.0.x series prior to the 18.0.80 release
• 18.0.80 through 18.0.80.3 — the first three patch releases of the newer branch, indicating the flaw was likely introduced or carried forward across a major feature release

The attack surface is the Plesk web control panel's authenticated API and management interface. Because Plesk manages database lifecycles (creation, deletion, backup, credential management, and content access) for hosted customers, the database-management subsystem is the logical attack surface. The IDOR flaw likely resides in a handler that performs operations on database objects by identifier without a corresponding ownership check.

Insufficient technical detail is available in the NVD description regarding the exact request structure, endpoint paths, or parameter names involved. The vulnerability is therefore described at the class level: an authenticated user can enumerate or guess database object references and operate on objects owned by other tenants. The impact is bidirectional — both "read" and "modify" are explicitly listed, meaning confidentiality and integrity are both compromised.

Exploitation Scenarios

Scenario 1 — Data Exfiltration by Malicious Tenant

1. Reconnaissance / Target Identification: An attacker with a legitimate customer account on a shared Plesk server begins by noting the identifier of their own database management endpoint via the control panel API. Identifiers are typically sequential or predictable integers, enabling the attacker to enumerate neighboring values.

2. Triggering the Flaw: The attacker submits a crafted request to the database-management handler, altering the identifier parameter to reference another customer's database rather than their own.

3. Payload / Execution Method (class-level): Because the flaw is an IDOR, no specially crafted payload is required beyond the manipulated object reference. The attacker simply changes the identifier component in the request URL or POST body. The server processes the request without verifying ownership.

4. Post-Exploitation Impact: The attacker retrieves the full content of another customer's database (the "read" capability), exfiltrating sensitive data such as credentials, personal information, or proprietary business data. If the endpoint also permits writes, the attacker may insert, delete, or alter records, potentially planting malicious content or corrupting application data.

Scenario 2 — Integrity Attack via Database Modification

1. Reconnaissance / Target Identification: The attacker identifies a high-value target database on the same server — for example, a database belonging to a competing business or an e-commerce customer storing payment-related data.

2. Triggering the Flaw: The attacker sends a modification request (e.g., an UPDATE or data-import operation) referencing the victim's database identifier.

3. Execution: The server-side handler executes the write operation against the victim's database without authorization checks.

4. Post-Exploitation Impact: The attacker alters financial records, injects false data, or destroys the database contents entirely. In a worst-case scenario, the modification capability enables embedding malicious content that later executes when the victim's web application reads the poisoned data.

Inference Note: No public PoC is available for this vulnerability. The attack chain above is inferred from the vulnerability class (IDOR) and the NVD description of capabilities ("read and modify"). Specific request formats and endpoint paths cannot be provided without additional vendor or researcher disclosure.

Impact Assessment

The business impact of CVE-2026-65642 is substantial for web-hosting providers operating Plesk-based control panels. Plesk is a multi-tenant platform; a single Plesk server routinely hosts dozens to hundreds of independent customers, each with separate databases. An IDOR that crosses tenant boundaries defeats the fundamental isolation promise of the hosting platform.

Confidentiality Impact: High — attackers can read arbitrary other-customer databases, exposing potentially sensitive data (customer PII, application credentials, financial records) that may trigger regulatory notification obligations under GDPR, HIPAA, or PCI DSS.

Integrity Impact: High — attackers can modify data in other customers' databases, enabling silent data manipulation, planted malware or backdoors in web applications, or destruction of critical data.

Availability Impact: Indirect but plausible — deletion or corruption of databases renders victim applications non-functional, causing service outages for downstream customers.

Affected Systems: All Plesk installations running 18.0.79.7 or earlier, or 18.0.80 through 18.0.80.3. Because no patch exists, every affected installation remains vulnerable.

Blast Radius: Containment of the vulnerable software does not mitigate cross-tenant impact — the blast radius encompasses every customer whose database resides on the same Plesk server as any malicious authenticated user. In shared-hosting environments with hundreds of tenants per server, this is effectively a complete compromise of the hosting platform's data plane.

CVSS Notes: No CVSS score has been assigned by any source. Based on the described impact profile (authenticated user, no privilege escalation required, high confidentiality and integrity impact, cross-tenant access), this vulnerability would reasonably score in the high-severity range (CVSS 7.0–9.0) if formally rated. This is an analytical estimate only and must not be treated as an official score.

Detection Guidance

The following detection rules are designed to identify exploitation attempts of CVE-2026-65642. Because the vulnerability is an IDOR in a management interface, detection focuses on anomalous access patterns to database-management endpoints, abnormal cross-tenant queries, and unusual data-transaction volumes.

Sigma Rule

title: Plesk IDOR - Cross-Tenant Database Object Access
id: 41a7c93f-65cd-4de6-bd41-cbdcbcbdbf12
status: experimental
description: Detects potential IDOR exploitation attempts against Plesk database management endpoints by identifying access to database objects that differ from a user's assigned objects.
logsource:
  product: plesk
  service: panel-access-log
detection:
  selection_base:
    action: 'allowed'
  selection_db_ops:
    request_uri|contains:
      - '/databases/'
      - '/api/'
  selection_id_normalized:
    - c-uri|contains: 'db_id='
    - c-uri|contains: 'id='  
  filter_numeric_id:
    c-uri|re: 'db_id=\d{3,}'
  condition: selection_base and selection_db_ops and not filter_numeric_id
  timeframe: 15m
level: medium
falsepositives: |
  - Legitimate dynamic database identifiers greater than 3 digits will trigger.
  - May require custom tuning to match actual Plesk URI structure.
fields:
  - src_ip
  - cs_username
  - c-uri
tags:
  - attack.t1190
  - cve.2026-65642
  - cwe.639

YARA Rule

rule CVE_2026_65642_Plesk_IDOR {
    meta:
        author = "ValterSIT SOC"
        description = "Detects exploit strings referencing Plesk database IDOR patterns"
        cve = "CVE-2026-65642"
        date = "2026-06-04"
    strings:
        $s1 = "/services/" ascii wide
        $s2 = "plesk_database" ascii wide
        $s3 = "database-id" ascii wide
        $s4 = "client/database" ascii wide
        $s5 = "id=" ascii wide
        $s6 = "session-id" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and
        2 of them and
        filesize < 1MB
}

Suricata IDS Rule

alert http any any -> $PLESK_SERVERS any (msg:"CVE-2026-65642 Plesk IDOR - Suspicious Database Object Reference Exfiltration";
    flow:established,to_server;
    http.uri;
    content:"/databases/";
    offset:0;
    pcre:"/(?:id|db_id|database_id)[=/]\d{2,}/i";
    threshold: type both, track by_src, count 10, seconds 60;
    metadata: cve CVE-2026-65642, cwe CWE-639, attack_target web_server, tag idor;
    sid: 56000121;
    rev: 1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where dns.question.name : "*plesk*"]
  [http where http.request.method in ("GET", "POST") and 
     wildcard(http.request.uri, "*/databases/*") and
     length(http.request.bytes) > 200]
  [http where http.response.status_code == 200 and
     wildcard(http.response.content_type, "application/json") and
     length(http.response.bytes) > 5000]
  | drop last

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/databases/*"
| stats count by clientip, user, uri_path, uri_query
| eval suspicious_db_access = if(match(uri_query, "(?i)id=\d+") AND match(user, "(?i)(client|reseller)") , "YES", "NO")
| search suspicious_db_access="YES" AND count>10
| table _time clientip user uri_path uri_query count
| sort - count

Wazuh OSSEC Rule

<group name="plesk,">
  <!-- CVE-2026-65642 Plesk IDOR - Cross-tenant database object access detection -->
  <rule id="100212" level="12">
    <decoded_as>idrac</decoded_as>
    <field name="request" type="regex">(?i)\/databases\/.*[=&](?:id|db_id|dbid)\d+</field>
    <description>CVE-2026-65642: Potential Plesk IDOR exploitation - cross-tenant database reference detected.</description>
    <group>attacker_attempt,exploit,cve-2026-65642,idor,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: 0/4 — UNPATCHED. No patch evidence is available from any tracked source. The vendor (Plesk) has not published a fix for either affected version branch. Organizations must not wait for a vendor patch; immediate compensating controls are essential.

1. Immediate Mitigations (compensating controls)

• Restrict Control-Panel Access: Implement network-level access control to limit Plesk management-panel access to trusted administrative IP ranges. Disable direct customer access to the panel where business processes permit. Note: this limits attack surface but does not fix the underlying flaw.
• API Key and Session Hardening: Enforce strict session timeout policies and rotate API keys. Monitor for simultaneous sessions from a single account across multiple IPs.
• Database-Level Access Controls: Even though the panel may permit cross-tenant database operations, enforce database-level authentication credentials on the underlying database server. Reduce panel-managed credentials to least-privilege per-tenant accounts that only have write access to their own databases — this will constrain the damage a malicious panel operation can do.
• Enable Audit Logging: Turn on full audit logging on both the Plesk panel and underlying database server. Ensure the database server's general query log or audit plugin captures ALL queries, including those issued through the panel's service account. Review logs for anomalous cross-schema operations.

2. Patch/Upgrade Steps

• Monitor the Plesk changelog on a daily basis for a security release addressing CVE-2026-65642.
• When available, update Plesk to the first version that includes the fix (expected to be ≥ 18.0.81, pending vendor confirmation).
• Do not implement any unofficial "community patches" — unvetted modifications to a control panel are highly risky and can introduce backdoors.
• Verify the patch is applied to both the panel software and any supporting components (e.g., database management agents) that the update includes.

3. Long-Term Hardening

• Architecture Review: Evaluate whether tenant databases should be isolated at the database-server level (separate database clusters per tenant group) rather than all residing on a single shared instance managed by one panel.
• Least-Privilege Panel Roles: Review Plesk user roles and ensure no customer has unnecessary administrative capability regarding database objects. Apply the principle of minimal object access in panel role configuration.
• Object-Level Authorization Testing: Add IDOR testing to the organization's regular security assessment scope. If the panel supports custom API integration, validate that each handler enforces object-ownership checks.
• Request-Signing/Anti-Enumeration: Consider a web application firewall (WAF) rule that rejects database-management requests containing sequential or low-entropy object identifiers when the requesting user's ownership cannot be verified.
• Incident Response Preparation: Even with all mitigations, assume compromise is possible. Prepare a playbook for tenant data isolation, backup restoration, and forensic capture specific to the Plesk database-management subsystem.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65642 — The authoritative vulnerability record containing the official CVE description, affected version list, and current status.

2. MITRE CWE-639 (Insecure Direct Object Reference): https://cwe.mitre.org/data/definitions/639.html — The weakness classification informing the technical analysis above, providing the formal definition and typical remediation approaches.

3. Plesk Release Notes / Changelog: https://docs.plesk.com/release-notes/ — Monitor this page for the vendor security advisory and patch release; as of this report, no fix is listed.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — The vulnerability is NOT listed on the KEV catalog as of the report date, meaning no evidence of in-the-wild exploitation has been confirmed by CISA.

5. ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — The MITRE ATT&CK technique associated with the exploitation of internet-exposed control panels like Plesk.

Additional Threat Intelligence Notes: No threat-actor campaign has been publicly attributed to this vulnerability as of June 2026, and there is no evidence of exploitation in the wild. However, the lack of a patch and the increasing operational tempo — including ongoing enumeration of control panels by botnets looking for exploitable management APIs in 2026 — suggests this vulnerability presents a high risk of being weaponized in the near term. The fact that a prior disclosure in the same class, followed by a patch gap in March 2025, fueled several hosting-compromise incidents (NTT hosting breach — June 2025) demonstrates the real-world exploitability of IDOR flaws in control-panel software. Security teams should treat this as a potential zero-day in a widely deployed control panel.