Dear Customer,

We are announcing a recently disclosed security vulnerability affecting Plesk, identified as CVE-2026-58046.

This vulnerability has been addressed by Plesk and requires immediate attention from all customers managing their own Plesk servers.

Vulnerability Summary

An improper input validation issue in the Plesk XML-RPC API allows a remote, authenticated, low-privileged user to perform SQL injection attacks and read arbitrary data from the Plesk database.

Successful exploitation may allow an attacker to:

  • Read sensitive information stored in the Plesk database.
  • Obtain administrator credentials.
  • Potentially compromise the entire server.

Affected Versions

  • Affected: All Plesk versions prior to 18.0.79.4
  • Fixed in: Plesk Obsidian 18.0.79.4

Immediate Action Required

We strongly recommend upgrading your server to Plesk 18.0.79.4 or later as soon as possible.

To update Plesk:

  1. Log in to your Plesk control panel.
  2. Navigate to Tools & Settings > Updates and Upgrades.
  3. Install all available Plesk updates.
  4. Confirm the installed version under Tools & Settings > Server Components.

Temporary Mitigation

Apply the following mitigation only if you cannot upgrade immediately.

Plesk Obsidian 18.x

  1. Connect to your server via SSH.
  2. Edit the panel.ini file.
  3. Add the following configuration:
[api]
deprecationError = on

This setting blocks deprecated XML API protocol versions that may be used to exploit this vulnerability.

Please note: This is only a temporary mitigation. You should still upgrade to Plesk 18.0.79.4 or later as soon as possible.

Plesk Onyx 17.x and Earlier

  1. Connect to your server via SSH.
  2. Edit the panel.ini file.
  3. Restrict XML API access to trusted IP addresses by adding the following configuration:
[api]
allowedIPs = 203.0.113.2,192.0.2.2

Replace the example IP addresses with the actual trusted IP addresses that require API access.

Important: Restricting or disabling the XML API will also affect REST API access.

Upgrade to the latest supported Plesk version as soon as possible.

Backup Reminder

Before performing any system or Plesk upgrade, please ensure that you have a current and verified backup of your server.

While software updates are generally safe, every server environment is unique. Maintaining current backups is the responsibility of the server owner.

We strongly recommend verifying that your backup is complete and can be restored successfully before making any changes to the server.

Additional Information

If you require assistance with the upgrade process or have any questions, please contact our support team.

Kind regards,
CCI Hosting Support Team



Tuesday, July 28, 2026

« Back