WebPros security advisory (AV26-790)
Serial Number: AV26-790 Date: August 10, 2026 As of August 7, 2026, WebPros is affected by a vulnerability in the following product: Plesk Obsidian Prior to 18.0.80.1 and 18.0.79.5 CVE-2026-64636 Vulnerability in Plesk: blind SQL injection
CSIRTS triage
- What
- Plesk Obsidian contains a blind SQL injection vulnerability (CVE-2026-64636).
- Who is affected
- Organizations running Plesk Obsidian versions prior to 18.0.80.1 or 18.0.79.5.
- Urgency
- High; SQL injection vulnerabilities enable database compromise and lateral movement within affected systems.
- Action
- Update Plesk Obsidian to version 18.0.80.1 or 18.0.79.5 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Plesk Obsidian
Get an email when a new Plesk Obsidian advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/webpros-security-advisory-av26-790
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-646360.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-64636 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from Canadian Centre for Cyber Security
- unknownWatchGuard security advisory (AV26-847)2026-08-25
- unknownOpenSSL security advisory (AV26-846)2026-08-25
- unknownGitea security advisory (AV26-845)2026-08-25
- unknownGoogle security advisory (AV26-844)2026-08-24
- criticalOracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 22026-08-24