CVE-2026-65646

9.9 criticalEPSS 0.7%

Critical (9.9). EPSS 0.7% chance of exploitation in the next 30 days.

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Severity

CVSS 3.0

9.9 critical

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2026-08-26
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

References

https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality

Check your stack JSON