CVE-2026-65642CWE-639

CVE-2026-65642

published August 27, 2026

CVSS
8.6
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00479 · 40.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-27T02:16Z
References (1)
https://support.plesk.com/hc/en-us/articles/42844242102679-Vulnerability-CVE-2026-65642-in-Plesk-s-database-management-interface · [email protected]
EPSS history
Timeline
  • 28 AUG 06:50Z
    EPSS moved — → 0%
    epss
  • 26 AUG 21:21Z
    Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other…
    cvelistv5