CVE-2026-65647

HighCVSS 8.7/10Last modified Sep 3, 2026

Description

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 26, 2026
Last modified
Sep 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-65656.4The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored CrossCVE-2026-656504.3Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.CVE-2026-656518.7temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree withoCVE-2026-656528.7github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that canCVE-2026-656538.7github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunksCVE-2026-656548.7github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected vCVE-2026-656552.3When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server oCVE-2026-656567.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to eCVE-2026-656577.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656588.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65664.3The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in CVE-2026-656608.8Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over
CVE-2026-65647: High severity, CVSS 8.7 | Vulnix