Quick answers
- Is CVE-2026-82977 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82977 being exploited in the wild.
- How severe is CVE-2026-82977?
- Informational severity, published 12 November 2026.
- Which products and versions are affected?
- Plesk Obsidian 18.0.77–18.0.81.7, 18.0.82–18.0.82.2.
- Is there a fix for CVE-2026-82977?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82977 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-82977?
- Check whether you run Plesk Obsidian at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Plesk GoAccess statistics integration fails to properly isolate statistics data between different subscriptions, allowing authenticated users to access traffic analytics across subscription boundaries. This is an authorization bypass affecting versions 18.0.77–18.0.81.7 and 18.0.82–18.0.82.2 on Linux deployments. No network-level attack vector is required; the vulnerability is exploitable by any authenticated hosting customer.
Affected products
- Plesk Obsidian 18.0.77–18.0.81.7, 18.0.82–18.0.82.2
Timeline
- 2026-11-12: disclosed