Full Report
WebPros security advisory (AV26-815)
Analysis Summary
# Vulnerability: Privilege Escalation via Database Cloning in Plesk
## CVE Details
- **CVE ID:** CVE-2026-64639
- **CVSS Score:** Not explicitly listed in source (Estimated High based on Privilege Escalation impact)
- **CWE:** CWE-269: Improper Privilege Management (Privilege Escalation)
## Affected Systems
- **Products:** WebPros Plesk (Windows and Linux versions)
- **Versions:**
- All versions prior to **18.0.79.6**
- All versions prior to **18.0.80.2**
- **Configurations:** Systems utilizing the database cloning functionality within the Plesk control panel.
## Vulnerability Description
CVE-2026-64639 is a privilege escalation vulnerability residing in the database cloning mechanism of the Plesk control panel. The flaw allows an authenticated user with limited privileges to manipulate the cloning process to gain elevated permissions on the underlying system or database server. This is typically achieved by exploiting how the application handles file permissions or user context during the duplication of database assets.
## Exploitation
- **Status:** Not explicitly reported as exploited in the wild; however, the advisory indicates the flaw is patched and publicly disclosed.
- **Complexity:** Medium (Requires authenticated access to the Plesk interface).
- **Attack Vector:** Network (Web Interface).
## Impact
- **Confidentiality:** High (Potential unauthorized access to all databases on the server).
- **Integrity:** High (Ability to modify or delete database content and system configurations).
- **Availability:** High (Potential for service disruption via database corruption or deletion).
## Remediation
### Patches
WebPros has released updates to address this vulnerability. Users should upgrade to one of the following versions or later:
- **Plesk 18.0.79.6**
- **Plesk 18.0.80.2**
### Workarounds
No specific functional workarounds were provided in the advisory. The primary recommendation is to restrict access to the Plesk control panel to trusted users and apply the security updates immediately.
## Detection
- **Indicators of Compromise:** Monitor Plesk action logs for unusual database cloning activity, especially those initiated by accounts that do not typically perform administrative tasks.
- **Detection methods:** Audit system logs for permission changes in the `/var/lib/mysql` (Linux) or database storage directories (Windows) coinciding with cloning operations.
## References
- **Vendor Advisory:** hxxps[://]support[.]plesk[.]com/hc/en-us/articles/42521305418903-Vulnerability-CVE-2026-64639-Privilege-Escalation-via-Database-Cloning-in-Plesk
- **Canadian Centre for Cyber Security:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/webpros-security-advisory-av26-815