One Hosting Customer Could Read the Server’s Secrets. Another Plesk Flaw Gave Them Root.

Plesk published advisories for CVE-2026-65646 and CVE-2026-65647 on 25 August 2026. Both begin with an unprivileged customer account. In a shared-hosting environment, both can end beyond that customer’s subscription.

Plesk has not said that either vulnerability is being exploited. No public proof of concept was identified at the time of writing. The absence of an observed campaign does not reduce the patching priority for multi-tenant servers, because the affected features sit directly on the boundary between one customer and every other customer hosted on the system.

The DNS flaw could disclose the credentials that protect the panel

CVE-2026-65646 affects the DNS zone-management functionality in Plesk Obsidian for Linux. A customer with an ordinary hosting subscription and a DNS-managed domain may be able to read arbitrary files from the server.

The prerequisite is narrower than unauthenticated internet access, but it is common by design. Shared-hosting customers are routinely allowed to manage DNS records for their own domains. The vulnerability turns that intended capability into access to files outside the customer’s boundary.

Plesk says the exposed files can include Plesk administrator and database credentials. Those secrets would give an attacker control of the management panel and access to databases hosted on the server. The original file-read primitive therefore has consequences beyond confidentiality: a tenant may be able to obtain the credentials needed to administer the platform.

The flaw affects Plesk for Linux 18.0.79.7 and earlier, plus releases from 18.0.80 through 18.0.80.3. Fixed versions are 18.0.79.8 and 18.0.80.4.

The extension flaw crosses directly into root

CVE-2026-65647 affects two extensions used to move sites and hosting data. An unprivileged Plesk user with a hosting subscription can execute arbitrary code with root privileges through affected versions of Plesk Migrator or Site Import.

Plesk says the issue does not depend on a special server configuration. Any server running an affected extension is vulnerable. In shared and multi-tenant hosting, successful exploitation gives the attacker administrative control of the server and access to every subscription hosted on it.

Plesk Migrator 2.35.0 and earlier must be updated to 2.36.0. Site Import 1.12.0 and earlier must be updated to 1.12.1.

The extensions deserve particular attention because their normal purpose already requires powerful operations. Plesk Migrator transfers hosting data and can work with root access on a source system. Site Import moves website files and databases into a subscription. A failure in the privilege boundary around those operations is not comparable to a cosmetic panel bug.

Two different paths reveal the same multi-tenant risk

The vulnerabilities are technically separate. The DNS issue is an arbitrary file-read path in the core Plesk platform. The extension issue is a local privilege-escalation path that reaches root. They also have different affected-version and remediation matrices.

Operationally, however, they expose the same assumption: a hosting customer should be able to manage only the resources assigned to that subscription. Once that boundary fails, the shared server becomes the blast radius.

This matters for hosting providers because a valid low-privilege account is not necessarily a strong barrier. Accounts can be purchased legitimately, created for trials, compromised through reused credentials, or retained after a customer relationship changes. A malicious tenant does not need to defeat the public login screen if the platform grants the account enough access to reach the vulnerable feature.

It also changes how defenders should interpret exposure. A server does not need to publish the vulnerable extension directly to the open internet for the risk to be serious. The relevant attack surface includes every customer able to authenticate to the panel.

Patch the panel and its extensions separately

• Update Plesk for Linux. Install 18.0.79.8, 18.0.80.4 or a later supported release to address CVE-2026-65646.
• Update both extensions where installed. Plesk Migrator must be 2.36.0 or later, and Site Import must be 1.12.1 or later, to address CVE-2026-65647.
• Inventory customer DNS access. Identify servers where customers can manage DNS records for their own domains, because Plesk explicitly identifies that configuration as affected by the file-read vulnerability.
• Do not assume the platform update covers extension code. Verify the installed extension versions independently after updating the panel.
• Review tenant activity. Examine panel, web, audit, process and authentication logs for unexpected DNS-management operations, extension use, file access, commands executed by privileged Plesk components and new administrator sessions.
• Rotate exposed secrets if compromise is plausible. A suspected arbitrary file read should trigger review and rotation of Plesk administrator credentials, database credentials, API tokens and other secrets available to the panel.
• Treat root-level suspicion as a host compromise. If the extension flaw may have been exploited, isolate the server, preserve evidence and assess the integrity of the operating system and every hosted subscription.

The customer account is the starting point, not the limit

Neither vulnerability requires an attacker to begin as the hosting provider’s administrator. That is the defining fact. One ordinary subscription can become a credential-recovery path, while another vulnerable component can turn the same level of access directly into root.

Shared hosting depends on strong separation between customers that use the same management plane and operating system. These Plesk fixes restore two parts of that separation. Providers should verify all three relevant versions rather than treating the incident as a single panel update.

Sources

• Plesk advisory for CVE-2026-65646, updated 25 August 2026 at 11:00; the page does not state a timezone.
• Plesk advisory for CVE-2026-65647, updated 25 August 2026 at 11:03; the page does not state a timezone.
• Plesk Migrator installation and prerequisites.