CVE-2026-65646

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.

We have discovered 102,151 live websites that are affected by CVE-2026-65646.

Run a Free Instant Scan



Affected Software

Product  Plesk
Category Hosting Panels
Vulnerable Domains102,151 live websites (100% of Plesk install base)
Vulnerable Versions
  • from 0 through 18.0.79.8
  • from 18.0.80 through 18.0.80.4
Vulnerable Versions Count61 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')



Details

  • Published - Aug 26, 2026
  • Updated - Aug 27, 2026

Credits

  • Aziz Knani (reporter)

Website Distribution by Country

Number of websites using CVE-2026-65646
United States15,653 websites


Germany28,038 websites
Netherlands10,697 websites
Spain6,175 websites
Turkey5,640 websites
France5,327 websites
GB5,239 websites
Italy4,867 websites
India1,585 websites
Lithuania1,226 websites

Website Distribution by TLD

Number of websites using CVE-2026-65646
.com33,951 websites
.de16,174 websites
.nl8,775 websites
.it4,111 websites
.net3,498 websites
.org3,269 websites
.co.uk2,891 websites
.es2,601 websites
.fr1,720 websites
.eu1,361 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-65646

Top websites that are affected by CVE-2026-65646. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.***.cn United States*,***
*******.com Germany**,***
********.**.uk GB**,***
******.******.com United States**,***
****.********.ru Germany**,***
***********.******.de Germany**,***
********.com United States**,***
**.*******.com Germany**,***
****.***.cn United States**,***
**************.de United States**,***
See full domain list

FAQ

CVE-2026-65646 is Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Plesk
A total of 102,151 websites have been identified as vulnerable to CVE-2026-65646, based on global website indexing conducted by WebTechSurvey.
The Plesk is affected by the CVE-2026-65646 vulnerability.
Plesk versions up to 18.0.80.4 are vulnerable to CVE-2026-65646.
CVE-2026-65646 is resolved in version 18.0.80.4 of Plesk.