High · published January 8, 2026
⚡ Attention Plesk users! A single crafted request could cause continuous service reloads, making your web interface unavailable! This vulnerability is like a pesky customer who keeps returning to a restaurant’s front door, causing a bottleneck that prevents others from getting in. Your legitimate users are left waiting outside while attackers enjoy the chaos! If exploited, an attacker could launch a Denial of Service (DoS) attack on your Plesk Obsidian instance, rendering it completely unavailable to your legitimate users. Imagine your website being a locked door, but instead of customers coming in, it just keeps getting banged on! This could lead to a significant disruption of your services and reputation. 🔥
This vulnerability is like a pesky customer who keeps returning to a restaurant’s front door, causing a bottleneck that prevents others from getting in. Your legitimate users are left waiting outside while attackers enjoy the chaos! The vulnerability resides in the get_password.php endpoint, where a malicious payload can trigger an infinite reload loop on the web interface. This allows attackers to exploit the issue remotely without needing any authentication, resulting in persistent denial of service.
If exploited, an attacker could launch a Denial of Service (DoS) attack on your Plesk Obsidian instance, rendering it completely unavailable to your legitimate users. Imagine your website being a locked door, but instead of customers coming in, it just keeps getting banged on! This could lead to a significant disruption of your services and reputation. 🔥 To remediate this issue, patch your Plesk Obsidian installation immediately to version 18.0.74 or later. Additionally, consider implementing rate limiting to mitigate potential DoS attacks. Regularly audit your server configurations to ensure no malicious traffic can affect your services. 🛡️ You've got this! By taking these steps, you’ll be protecting your services and keeping those doors wide open for your legitimate users! 🚀