CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

Scoring

Severity

HIGH

CVSS base score

8.7

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.50%

CWE

CWE-59

Published

2026-08-26

Last modified

2026-08-27

Affected products

• WebPros Plesk Migrator
• WebPros Plesk Site Import

Weakness type

• CWE-59

Related vulnerabilities

• CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
• CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
• CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
• CVE-2026-69425 — Windows NTFS Tampering Vulnerability
• CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
• CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
• CVE-2026-70563 — Windows Shell Spoofing Vulnerability
• CVE-2026-69771 — Windows Container Manager Service Security Feature Bypass Vulnerability

Markdown version · Browse all CVEs