High severity · published Aug 26, 2026
CVE-2026-65647
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root
8.7
CVSS
0.7%
EPSS
No
On KEV
Description
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PM
Plesk Migrator · WebPros
before 2.36.0 · source: vendor
PS
Plesk Site Import · WebPros
before 1.12.1 · source: vendor