Plesk CVE-2026-58046 | Critical Security Vulnerability & Guide de réparation

A critical security update has been released for Plesk

Plesk has disclosed and patched a high-severity security vulnerability tracked as CVE-2026-58046. The issue affects the XML-RPC API and impacts all Plesk versions prior to 18.0.79.4.

The vulnerability allows an authenticated user with low privileges to exploit a SQL injection flaw within the XML-RPC API. Successful exploitation may expose sensitive information stored in the Plesk database, including administrator credentials, and in certain scenarios could ultimately lead to full server compromise.

Administrators running affected versions should update their servers as soon as possible.

Versions concernées

How the vulnerability works

According to the official advisory, the vulnerability originates from improper neutralization of input within the XML-RPC API.

Under specific conditions, an authenticated user can submit specially crafted requests that manipulate SQL queries executed by the Plesk backend.

Unlike vulnerabilities that only expose limited information, SQL injection flaws can provide direct access to backend databases. Depending on the server configuration and stored data, attackers may retrieve administrative credentials, informations client, service configuration details, or other sensitive records.

Hébergement Web WordPress

À partir de 3,99 $/mois

Acheter maintenant

Although authentication is required, hosting providers and organizations operating shared environments should consider this issue a high priority because multiple users commonly have access to the control panel.

Potential Impact

Servers that remain unpatched may be exposed to several risks, y compris:

• Reading arbitrary records from the Plesk database
• Disclosure of administrator credentials
• Exposure of customer information
• Privilege escalation
• Complete server compromise in certain scenarios

The actual impact depends on server configuration, autorisations utilisateur, extensions installées, and the sensitivity of stored information.

Determine Your Installed Version

Before applying any changes, verify the installed version of Plesk.

From the Plesk interface:

Outils & Settings → Server Components

Serveur VPS pas cher

À partir de 2,99 $/mois

Acheter maintenant

Or using SSH:

plesk version

If the reported version is earlier than 18.0.79.4, the server should be updated immediately.Updating Plesk

Plesk recommends installing the latest available updates without delay.

To update through the web interface:

1. Sign in to Plesk.
2. Ouvrir Outils & Paramètres.
3. Sélectionner Updates and Upgrades.
4. Install all available updates.
5. Confirm that the installed version is 18.0.79.4 or newer.

Before performing any production update, ensure that a recent system backup is available.

Temporary Mitigation

If an immediate upgrade is not possible, Plesk recommends enabling strict XML API protocol validation.

Hébergement VPS Windows

Remote Access & Full Admin

Acheter maintenant

Modifier le panel.ini file and add:

[api]
deprecationError = on

This setting blocks deprecated XML API protocol versions that may bypass input validation, reducing the likelihood of successful exploitation.

It should only be considered a temporary mitigation until the official update can be installed.

Additional Protection for Plesk Onyx

Administrators still running Plesk Onyx 17.x or older releases should restrict XML API access to trusted IP addresses.

Exemple de configuration:

[api]
allowedIPs = 203.0.113.2,192.0.2.2

Replace the example IP addresses with the systems that legitimately require XML API access.

Be aware that restricting or disabling XML API access may also affect applications using the Plesk REST API.

Security Recommendations

Keeping Plesk up to date is the most effective protection against this vulnerability, but additional security measures should also be part of every server administration strategy.

Limit Administrative Access

Restrict administrator access to trusted IP addresses whenever possible and avoid exposing management interfaces to the public Internet.

Enable Multi-Factor Authentication

Two-factor authentication significantly reduces the risk of account compromise, even if user credentials are leaked.

Review User Accounts

Because exploitation requires an authenticated account, administrators should periodically review existing users, remove inactive accounts, and ensure that users have only the permissions they require.

Monitor Server Logs

Review authentication logs, database activity, and API access logs for unusual behavior, especially if the server has remained unpatched for an extended period.

Apply Security Updates Regularly

Security patches should be installed as part of routine maintenance rather than postponed until vulnerabilities become publicly exploited.

Foire aux questions

Is CVE-2026-58046 remotely exploitable?

Oui, but the attacker must first authenticate with a valid low-privileged Plesk account.

Which Plesk versions are affected?

Every version earlier than 18.0.79.4.

Does the mitigation completely fix the vulnerability?

Non. The mitigation reduces the attack surface but does not replace the official security update.

How do I know whether my server is protected?

Verify that your server is running S'il te plaît 18.0.79.4 or a newer version.

Should managed hosting customers take action?

If your provider manages operating system and control panel updates, contact them to confirm that the security update has already been applied.