CVE-2026-65646CWE-74

CVE-2026-65646

Critical · published August 27, 2026

CVSS v3.0
9.9
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

The record
Technical detail
CVSS v3.0
9.9 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-08-27T02:16Z
References (1)
https://support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionality · [email protected]
EPSS history
Timeline
  • 28 AUG 06:50Z
    EPSS moved — → 0%
    epss
  • 26 AUG 21:21Z
    Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges
    cvelistv5