Plesk 18.0.82 Update 3: critical fix, Roundcube 1.6.21, AJP

On 12 November 2026 Plesk released Obsidian 18.0.82 Update 3 and 18.0.81 Update 8. Both carry the change log line "This update addresses a critical security issue" with no CVE or details, so treat them like any other critical Plesk patch: install today. They also undo the AJP and Unix-socket breakage from last week's update and bring Roundcube up to 1.6.21.

This note is for admins running Plesk fleets. It covers what changed, which build you should land on, and what to clean up afterwards.

What's in the update

Target builds: 18.0.82.3 on the current branch, or 18.0.81.8 if you're still on 18.0.81. Debian 11 servers stay on 18.0.81, so 18.0.81.8 is the end of the line for them until you upgrade to Debian 12.

Install and verify

plesk installer --select-release-current --upgrade-installed-components
plesk version

plesk version should report 18.0.82.3 or 18.0.81.8. If the installer fails, work through the Plesk update failure guide rather than leaving the server one patch behind.

On the forum, an admin reported that Update 2 didn't restart Apache on AlmaLinux 8, 9, or 10, and Plesk said it would investigate. Check that Apache restarted after this update. If it didn't, restart it yourself so the fixes are actually loaded. The commands below are for AlmaLinux and other RHEL-based servers. On Debian and Ubuntu the unit is apache2.

journalctl -u httpd --since today | tail
systemctl restart httpd

Undo your proxy lock workarounds

Update 2 and Update 7 added mod_proxy_lock, which refused AJP and HTTP over Unix-socket backends. If you followed our proxy_lock troubleshooting guide, roll back the temporary parts now:

• Disabled the module server-wide? Re-enable it. That was the only workaround that removed the protection for every domain.

plesk sbin httpd_modules_ctl -e proxy_lock
systemctl restart httpd
apachectl -M | grep proxy_lock

• Installed the forum test build? The official packages should replace it. Confirm that the LoadModule line in /etc/httpd/conf.d/proxy_lock.conf isn't commented out.
• Switched Tomcat from AJP to the HTTP connector? Keep it. It's the simpler setup and doesn't depend on proxy lock behaviour.

Roundcube 1.6.21

Roundcube released 1.6.21 and 1.7.6 on 9 November with 17 security fixes. They cover Sieve script injection, IMAP command injection when messages_cache is on, two SSRF filter bypasses in the CSS proxy, three CSRF gaps (ManageSieve deletes and mail purge among them), a disabled_actions bypass, unsafe attachment data passed to ImageMagick, and a session-parsing CPU loop. No CVE IDs were assigned at release.

Webmail is exposed to every mailbox user, which makes this the most practical reason to update today. Roundcube also warns that the 1.6 branch will be discontinued "rather soon". Plesk still ships 1.6, so expect a 1.7 move in a later release and test any Roundcube plugins you've customised before it lands.

Windows: MS SQL database visibility

18.0.82 started explicitly denying VIEW ANY DATABASE, so users couldn't see their databases in SSMS and HeidiSQL showed only one. Update 3 adds a panel.ini option. To fix affected users, add:

[databaseManagement]
mssqlViewAnyDatabase = revoke

Then run plesk bin repair --update-mssql-users-permissions and remove the lines again. The other values are default (Plesk doesn't manage the permission, which matches pre-18.0.82 behaviour), deny, and grant.

Also patch Site Import

On 4 November Plesk released Site Import 1.13.2 for another critical issue, CVE-2026-107246. It's an extension, so check Extensions » My Extensions for it as well as the core update.

Next steps

• Plesk Obsidian 18.0.82 release notes cover the rest of the branch, including the deprecations due in 18.0.84.
• Plesk repair utility commands explain how to rebuild configs safely when vhosts drift after template changes.
• Need licenses for new Plesk servers or a different edition? See the Plesk license page or compare Plesk editions.