External risk intelligence

Plesk 18.0 Incorrect Access Control Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-66430

Plesk is a widely used web hosting control panel platform designed to be internet-facing for the purpose of managing web servers, websites, and hosting services. Its primary function involves providing an accessible interface for administrators and users over the public internet, making it a service that is public-facing by design in normal deployment scenarios.

Plesk

18.0.70 to before 18.0.73.518.0.74 to before 18.0.74.2

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Plesk's access control could allow unauthorized users to gain elevated privileges on affected servers. As Plesk is internet-facing by design for web hosting management, this issue presents a significant potential risk to server security and data. The primary concern is to confirm if our environment is exposed and understand the potential implications.

Flaw allows unauthorized access to server control.
Publicly accessible Plesk instances are at risk.
Confirm exposure and assess potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could access the Plesk platform over the internet, leveraging a weakness in how access is controlled. This could allow them to escalate privileges, potentially gaining root-level control over the server.

No authentication required.
Exploits incorrect access control.
Potential for root-level server access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain unauthorized root-level access to a Plesk server when supported by the advisory. This could affect the integrity and confidentiality of the entire server.

Server access and data integrity at risk.
Unauthenticated network access is possible.
Unauthorized root access to the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Plesk affects the access control for password-protected directories, potentially allowing unauthorized root-level server access. Owners of the Plesk platform, likely platform or infrastructure teams, must first identify all instances of the affected Plesk versions, confirm their internet reachability, and assess business criticality to prioritize remediation efforts. Coordination with the vendor and planning for maintenance windows will be essential steps in mitigating this risk.

Platform/Infrastructure teams own this issue.
Verify internet exposure and business criticality.
Plan vendor-coordinated remediation and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Plesk and how is it used?

Plesk is a widely adopted web hosting control panel that provides a graphical interface for managing websites, databases, and server configurations. It serves as a central hub for administrators to oversee complex web environments, making it a critical tool for service providers and web professionals who need to manage multiple domains and server settings from a single dashboard.

What does Incorrect Access Control mean for CVE-2025-66430?

This vulnerability falls under the CWE-284 weakness class, which identifies flaws where a system fails to properly restrict access to sensitive resources. In this specific case, the software does not correctly enforce security boundaries for password-protected directories, allowing an unauthorized party to bypass intended permissions and interact with parts of the server they should not be able to reach.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the Plesk server over a network connection without needing prior authentication. The vulnerability exists specifically within the handling of password-protected directories, meaning the bug is triggered by requests targeting these protected areas. Simply accessing the standard public web pages of a hosted site does not necessarily invoke the faulty access logic.

Is my Plesk instance at risk if it is internal?

Halo Surface Signal indicates that Plesk is designed to be internet-facing by default to support remote management of web services. While the vulnerability requires network access, any instance reachable from the public internet faces the highest risk. If your Plesk instance is restricted to a private, non-public network, the immediate threat is lower, though internal access still poses a risk if unauthorized users can reach the service.

What are the first steps to secure my server?

Begin by identifying all Plesk installations within your environment and checking their versions against the affected ranges in the advisory. Once identified, evaluate the internet exposure of each instance and prioritize patching. Since this involves potential root-level access, coordinate with your infrastructure team to plan a maintenance window for applying the vendor-provided updates immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.