CVE-2026-64637 is a critical security vulnerability affecting Plesk versions prior to 18.0.80. The flaw resides in the XML-RPC API where improper privilege management enables an authenticated reseller-level user to escalate their privileges and gain an administrative session as the root user. The vulnerability has a CVSS 3.0 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. This vulnerability corresponds to CWE-269 (Improper Privilege Management). No known exploits in the wild have been reported, and no patch links or vendor advisories were provided in the input data.

An authenticated reseller can obtain an administrative session with root privileges, potentially allowing full control over the affected Plesk server. This includes the ability to modify configurations, access sensitive data, and execute arbitrary commands with administrative rights. The vulnerability poses a critical risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor vendor communications for updates and consider restricting reseller access or disabling the XML-RPC API if feasible until a fix is available.