WebPros security advisory (AV26-854)
Serial number: AV26-854 Date: August 27, 2026 As of August 26, 2026, WebPros is affected by vulnerabilities in the following products: Plesk Prior to 18.0.79.8 Prior to 18.0.80.4 Plesk Migrator Prior to 2.36.0 Plesk Site Import Prior to 1.12.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerability CVE-2026-65642 in Plesk's database management interface Vulnerability CVE-2026-65647 in Plesk's Site Import and Migrator extensions
CSIRTS triage
- What
- Plesk database management interface and Site Import/Migrator extensions contain vulnerabilities CVE-2026-65642 and CVE-2026-65647.
- Who is affected
- Plesk installations below version 18.0.79.8 or 18.0.80.4, and Plesk Migrator/Site Import before patched versions.
- Urgency
- Apply patches promptly as these affect core management and migration functionality.
- Action
- Upgrade Plesk to 18.0.79.8 or later, Plesk Migrator to 2.36.0 or later, and Site Import to 1.12.1 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Plesk
Get an email when a new Plesk advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/webpros-security-advisory-av26-854
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-656420.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 40% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-656470.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-65642 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-65647 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from Canadian Centre for Cyber Security
- unknownMikrotik security advisory (AV26-887) – Update 12026-09-11
- criticalAL26-020 - Vulnerabilities Impacting MikroTik RouterOS - CVE-2026-67276, CVE-2026-67277 and CVE-2026-860602026-09-10
- unknownHPE security advisory (AV26-909)2026-09-10
- unknownWebPros security advisory (AV26-908)2026-09-10
- unknownAdobe security advisory (AV26-808) – Update 12026-09-10