Plesk has released fixes for three critical vulnerabilities: CVE-2026-65646, CVE-2026-65642, and CVE-2026-65647. Two require a Plesk microupdate. The third requires separate updates for Plesk Migrator and Site Import.
A server can have the patched Plesk build and still remain vulnerable through the extensions. Check all three versions rather than stopping after plesk version reports a current build.
What the vulnerabilities expose
| CVE | Component | Impact |
|---|---|---|
| CVE-2026-65646 | DNS zone management | A customer with a DNS-managed domain can read arbitrary server files and recover Plesk administrator and database credentials. |
| CVE-2026-65642 | Database management interface | An authenticated user can read, modify, or delete databases owned by other Plesk users. |
| CVE-2026-65647 | Plesk Migrator and Site Import | An unprivileged user can execute arbitrary code as root. |
These flaws matter most on multi-tenant servers. A normal customer account is enough to reach the affected paths; the attacker does not need an existing administrator login.
Affected and patched versions
| Component | Affected | Patched |
|---|---|---|
| Plesk for Linux 18.0.79 | 18.0.79.7 and earlier | 18.0.79.8 |
| Plesk for Linux 18.0.80 | 18.0.80 through 18.0.80.3 | 18.0.80.4 |
| Plesk Migrator | 2.35.0 and earlier | 2.36.0 |
| Site Import | 1.12.0 and earlier | 1.12.1 |
If your server runs an older Plesk branch, update to a supported patched build. Keeping a current Plesk license ensures the server remains eligible for vendor microupdates.
Check the installed versions
Run the following as root:
plesk version
for ext in panel-migrator site-import; do
version=$(grep -oPm1 '(?<=<version>)[^<]+' "/usr/local/psa/admin/plib/modules/$ext/meta.xml")
printf '%-16s %s\n' "$ext" "$version"
done
Safe output must show either Plesk 18.0.79.8 or 18.0.80.4, Plesk Migrator 2.36.0 or later, and Site Import 1.12.1 or later. The Plesk 18.0.79 release notes cover the wider changes in that branch.
Install the fixes
Take a current server backup, then install the latest Plesk microupdate from Tools & Settings > Updates and Upgrades. Update both extensions separately:
plesk bin extension --upgrade panel-migrator
plesk bin extension --upgrade site-import
Run the version checks again after the upgrade. Do not treat an updated core as proof that the extensions were updated; Plesk distributes them through separate channels.
Restricting customer access is not a durable substitute for patching. Firewall rules can reduce exposure around the panel, as described in the Plesk Firewall setup guide, but these flaws are reachable by authorised low-privilege users.