Issue This update addresses a critical security issue. We strongly recommend that you apply it as soon as possible.

[Azurel]

Server operating system version

AlmaLinux 8.10

Plesk version and microupdate number

18.0.74#2

In Changelog I found this

This update addresses a critical security issue. We strongly recommend that you apply it as soon as possible.

for Plesk Obsidian 18.0.74 Update 2 and Plesk Obsidian 18.0.73 Update 5.

If this is so very important, why is no corresponding notification sent to the admin account by email? I receive an email when an update has been installed automatically, but not when urgent action is required? Or has anyone received such a notice?

 

[Sebahat.hadzhi]

Plesk (and most control panels) generally do not send proactive “security advisory” emails to server admins, even when an update contains a security patch. What you can do is to sign up for our Release Notes RSS feed:

• https://docs.plesk.com/release-notes/obsidian/change-log/rss.xml

This way you can track the changelog and opt for an upgrade whenever desirable.

 

[Ladylinux]

What is the actual security issue ??

And no for security issues Plesk should do a better job of notifying owners of licenses.

Ladylinux

 

[Maarten]

I’ve shared a suggestion regarding this issue in the Plesk Suggestions and Feedback forum for Plesk to improve security notifications:

Input - Provide detailed security information and a dedicated security mailing list

When Plesk sends a notification about a “critical security update”, the only information we receive is the short message shown on the changelog. There is no CVE, no affected component, and no severity score. Looking at the inf3 files in the autoinstall directory, it’s difficult to determine...

talk.plesk.com

 

[Ladylinux]

Unbelievable

This is the actual vulnerability

https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root

https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root

No where is it even clearly shown that this affects earlier Plesk Versions and those just have clunky workarounds!!

Unacceptable Plesk!!

 

[Maarten]

Interesting. How did you find these articles?

 

[Ladylinux]

Hi,

I would edit but you only give people a few minutes to edit or delete

Unbelievable this is a ROOT level Vulnerability!!!

This is the actual vulnerability


https://support.plesk.com/hc/en-us/...s-to-execute-arbitrary-code-on-behalf-of-root

And

https://support.plesk.com/hc/en-us/articles/36261922405015--CVE-2025-66430-Security-vulnerability-in-Password-Protected-Directories-allows-Plesk-users-to-gain-root-level-access-to-a-Plesk-server

No where is it even clearly shown that this affects earlier Plesk Versions and those just have clunky workarounds!!

Unacceptable Plesk!!

 

[Ladylinux]

Interesting. How did you find these articles?

By digging around

Not how its suppose to be done by a so called professional company

Sick of excuses so disregard my tone please

 

[Azurel]

It would be really helpful if security advisories clarified whether an issue can be exploited remotely by an unauthenticated visitor or requires existing access to Plesk (e.g., as a customer or admin).

I don't have any customers or additional admins, yet these critical security warnings always put me on high alert, only to find out weeks later that the vulnerability required authenticated access. A little more transparency about the actual risk would be greatly appreciated!

 

[nmdpa3]

Unbelievable

This is the actual vulnerability

https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root

https://support.plesk.com/hc/en-us/articles/36494997377687--CVE-2025-66431-Security-vulnerability-in-domain-creation-mechanism-allows-Plesk-users-to-execute-arbitrary-code-on-behalf-of-root

No where is it even clearly shown that this affects earlier Plesk Versions and those just have clunky workarounds!!

Unacceptable Plesk!!

I'm a bit confused by your response. You're referencing articles published approximately 11 months ago.

Are you suggesting that Plesk has only now released a patch for a vulnerability that has been publicly documented on its own website for nearly a year?

If so, could you please clarify why the vulnerability remained unpatched for that length of time, or whether the recently released update addresses a different issue?

 

[tessa67]

@nmdpa3 I think there’s just a timing mix-up here. The two articles Ladylinux linked (CVE-2025-66430 and CVE-2025-66431) were published in December 2025, right when this thread started, and they belong to exactly the update Azurel asked about (18.0.74 Update 2 / 18.0.73 Update 5). Both articles list 18.0.73.5 and 18.0.74.2 as the fixed versions, so the vulnerabilities were not left unpatched for a year.

@Azurel you’re right about the exposure. Both are local privilege escalations: an attacker needs a logged-in Plesk user account (for CVE-2025-66431 even with specific permissions like site and domain management). If you run a server without customers or additional admins, that attack path essentially doesn’t exist for you. Updating is still the right call, but no reason for panic.

@Ladylinux fair point that older versions are less convenient: for 18.0.72 and earlier, the articles only offer an upgrade to the next release or a manual patch/workaround.

What does remain a legitimate criticism is the communication. “Critical security issue” without CVE, component or required privileges is hard to assess when the details only show up later on the support site. Maarten’s suggestion for proper advisories deserves an upvote.

Regards
Tessa

 

[trialotto]

@tessa67 and @AlL ............ and @Sebahat.hadzhi

This quote

What does remain a legitimate criticism is the communication. “Critical security issue” without CVE, component or required privileges is hard to assess when the details only show up later on the support site. Maarten’s suggestion for proper advisories deserves an upvote

is something that also - again - applies to the latest MU3 (on 18.0.82) and MU8 (18.0.81).


A line like

"This update addresses a critical security issue. We strongly recommend that you apply it as soon as possible."

in the release notes should not be sufficient.


@Sebahat.hadzhi .......... I can imagine that Plesk does not want to share sensitive information online, but there is also a Plesk forum.

For instance, it could also be considered to add "sensitive data" to that part of the Plesk forum that is not accessible to all of Plesk users.

That way, some of the (active) Plesk users can contribute at least to the Plesk forum, by using the up-to-date information to help out ALL Plesk users.....

Nevertheless, it is often better to share all information with everybody.

So, two options : share some information ....... or share all information with everybody.

Please note that some shared information can also lead to some feedback to Plesk team - this can speed up development of security patches.

Stated differently, I do not really understand why Plesk does not take advantage of the latter.


In conclusion, NOT an option : sharing no information at all with nobody.

It simple does not make sense.

Kind regards....