Critical severity9.9NVD Advisory· Published Aug 26, 2026· Updated Sep 11, 2026

CVE-2026-65646

Description

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Affected products

Plesk/Pleskllm-fuzzy

Patches

Vulnerability mechanics

References

support.plesk.com/hc/en-us/articles/42877023875351-Vulnerability-CVE-2026-65646-in-Plesk-s-DNS-zone-management-functionalitynvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000