The "critical security issue" behind last week's Plesk 18.0.82 Update 3 now has a name. CVE-2026-82977, published on 12 November 2026, is a cross-subscription information disclosure in the GoAccess web statistics integration on Plesk for Linux. One customer on a shared server can read another customer's web statistics.
If you already installed 18.0.82 Update 3 or 18.0.81 Update 8, the bug is fixed. You may still have secrets to rotate. This note covers who was exposed, how to confirm the fix, and what to clean up.
Affected and patched builds
| Product | Affected | Patched |
|---|---|---|
| Plesk for Linux | 18.0.77 – 18.0.81.7 | 18.0.81.8 |
| Plesk for Linux | 18.0.82 – 18.0.82.2 | 18.0.82.3 |
| Plesk for Windows | Not affected | — |
The CNA (HackerOne) scores it 8.4 High on CVSS 4.0 (AV:N/AC:L/PR:L/UI:N) and classes it as CWE-732, incorrect permission assignment. It needs a low-privileged account, and there's no user interaction. On a shared server, that means any customer. It isn't in CISA's KEV catalogue, and no public exploit had been reported at the time of writing.
The affected range starts at 18.0.77, the first release with GoAccess as Plesk's default statistics tool. AWStats was then formally deprecated in 18.0.79, so most Linux domains created or switched since then use GoAccess.
What leaks
According to Plesk, the exposed statistics can include:
- Full request URLs, query strings included. Password-reset links, magic-login links, preview or share links, WooCommerce order keys, and API keys that apps pass as GET parameters.
- Visitor IP addresses. This is personal data under GDPR, which matters if you host EU customers.
- Referring pages. These can expose private admin or intranet URLs.
Patch and verify
plesk installer --select-release-current --upgrade-installed-components
plesk version
You need 18.0.82.3, 18.0.81.8, or later. Debian 11 servers can't go past the 18.0.81 branch, so 18.0.81.8 is their fix until you move them to Debian 12. If the installer stalls, work through the Plesk update failure guide instead of leaving the server unpatched.
Can't patch today
Turn off web statistics on shared servers until you can patch. The supported CLI loops over every subscription:
plesk bin subscription --list > /root/subscriptions.txt
while read -r d; do plesk bin domain --update "$d" -webstat none; done < /root/subscriptions.txt
Plesk's advisory lists no workaround, only the update. Webalizer isn't a stopgap on newer systems either, because it isn't packaged on AlmaLinux 10 or Debian 13.
Rotate exposed secrets
Plesk's advisory asks admins to "rotate secrets or tokens" that could have appeared in request URLs. Patching closes the hole but doesn't revoke anything already read. On shared servers, prioritise:
- Sites that pass tokens in GET parameters. Custom apps, headless CMS preview links, and payment or webhook callbacks with keys in the query string.
- Password-reset and login links issued in the exposure window. Most expire within hours, but force-expire long-lived ones.
- Admin URLs that work as secrets. Examples are hidden login paths and staging subdomains that rely on obscurity.
On a single-tenant VPS, every subscription belongs to the same customer, so the cross-subscription risk is small. Patch anyway and skip the rotation drill.
What is CVE-2026-82977 in Plesk?+
Which Plesk versions fix CVE-2026-82977?+
Is Plesk for Windows affected by CVE-2026-82977?+
Is CVE-2026-82977 the same issue as Plesk 18.0.82 Update 3?+
Do I need to rotate anything after patching Plesk?+
Next steps
- Plesk Obsidian 18.0.82 release notes cover the rest of the branch and its upcoming deprecations.
- Plesk security advisory CVE-2026-68492 is another recent Plesk patch to check off.
- Running Plesk on a shared fleet? Check the Plesk license page or compare Plesk editions for Web Host pricing.