Medium SEVERITY — Security Update

Plesk Obsidian 18.0.x security micro-updates released

A micro-update package containing various security improvements for the panel, web server and DNS components.

Platform

Plesk

Version

Obsidian 18

Published

16 July 2026

Views

Scope

Improvements to panel session and API authentication security
Header hardening in nginx/Apache configuration templates
Fixes for Bind/DNSSEC signing
Dependency updates in Node.js and Docker extensions

Plesk micro-updates are configured to be applied automatically; a plan has been prepared for servers that are still using manual updates.

Plesk — Related Advisories

VIEW ALL →

Plesk 14 Sep 2026

High · 8.7

CVE-2026-68489 — Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authentic

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

CVE-2026-68489 Vulnerability 24

Plesk 26 Aug 2026

High · 8.7

CVE-2026-65646 — Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.

CVE-2026-65646 Vulnerability 25

Plesk 26 Aug 2026

High · 8.7

CVE-2026-65647 — Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

CVE-2026-65647 Vulnerability 26