CVE-2026-87886: Acronis Backup Plugin Privilege Escalation Flaw Exploited in Targeted Attacks

Acronis has disclosed a high-severity Linux privilege-escalation vulnerability affecting its Backup integrations for cPanel & WHM and Plesk after detecting exploitation in targeted attacks. Tracked as CVE-2026-87886 and rated 7.8 on the CVSS scale by Acronis, the flaw stems from insecure file permissions and can allow an authenticated attacker with limited privileges to increase their access on a vulnerable hosting server.

Acronis confirmed that exploitation has been observed in the wild against Acronis Backup plugin for cPanel & WHM deployments. The company has not reported corresponding active exploitation against the Plesk extension.

The vulnerability is particularly significant for web hosting providers and managed service providers because these plugins connect hosting control panels to Acronis backup infrastructure and support backup and recovery of websites, databases, mailboxes, and entire servers. A successful privilege-escalation attack could therefore turn access to a lower-privileged hosting account into much broader control of the underlying Linux system.

On September 16, 2026, CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog, confirming exploitation and requiring affected U.S. federal civilian agencies to remediate the issue by September 19, 2026.

Contact Sales

CVE-2026-87886 analysis

The vulnerability results from insecure default file permissions within the affected Acronis Backup integrations. Acronis describes the weakness as a local privilege-escalation issue, while CISA categorizes it as CWE-276: Incorrect Default Permissions.

The most important details for CVE-2026-87886 are its prerequisite conditions. An attacker must already have authenticated, low-privileged access to the Linux server. The flaw does not provide an unauthenticated attacker on the internet with direct initial access to cPanel, WHM, or Plesk. Instead, it allows someone who has already obtained limited local access to cross a privilege boundary and obtain substantially greater control.

Because exploitation requires local privileges, realistic attack scenarios include a compromised hosting account, stolen credentials, exploitation of another application hosted on the server, abuse by a malicious tenant, or another vulnerability that first provides low-level code execution.

Once that foothold exists, the insecure permission configuration can potentially allow attacker-controlled modifications to files involved in privileged Acronis plugin operations. Successful abuse can then lead to arbitrary code execution at a higher privilege level, potentially including root-level access depending on the affected execution path. The public reports state that exploitation can affect confidentiality and integrity of the vulnerable application and host.

CVE-2026-87886 affects the following Linux products and builds:

• Acronis Backup plugin for cPanel & WHM: versions before build 1.9.3.1021
• Acronis Backup extension for Plesk: versions before build 1.8.11.638

For cPanel and WHM, Acronis fixed the vulnerability in version 1.9.3 HF3, build 1021. The vendor’s release notes show that this release was published on September 11 and specifically contains security fixes. Acronis has since released version 1.9.4, build 1022, which is newer and therefore also contains the corrected code.

For Plesk, the issue is fixed in Acronis Backup extension 1.8.11, build 638. Acronis’ Plesk release notes identify build 638 as containing security fixes associated with the September security update.

The underlying risk is amplified in shared hosting environments. A single physical or virtual Linux server may host many customer accounts, applications, and websites. A privilege-escalation path from one compromised low-privileged account to the operating-system administrator context can therefore turn a localized website breach into compromise of the wider server.

Once privileged access is achieved, a threat actor could potentially access data belonging to other tenants, modify hosted sites, read configuration files and credentials, tamper with backups or recovery infrastructure, install persistence, disable security tooling, or use the server as a stepping stone into other systems. These are potential consequences of privileged Linux compromise rather than actions Acronis has specifically attributed to the observed campaign.

The distinction is important because Acronis has not disclosed what attackers are doing after successfully exploiting the vulnerability. The vendor has not published information about malware payloads, persistence mechanisms, data theft, ransomware, cryptomining, or other post-exploitation activity associated with the attacks.

Acronis has also not identified the threat actors behind the campaign, their geographic focus, targeted hosting providers, or the initial-access techniques used before privilege escalation. The company described the observed activity only as limited, targeted attacks against cPanel & WHM deployments.

The exact private discovery date has not been disclosed. Acronis’ advisory record for SEC-10986 was published on September 15, 2026, while the CVE and broader public reporting appeared on September 16.

A public CVE-2026-87886 PoC was not identified in Acronis’ disclosure or the two requested reports at the time of publication. Confirmed active exploitation nevertheless proves that at least one threat actor already possesses a working method for abusing the insecure permissions.

There are currently no vendor-published CVE-2026-87886 IOCs such as attacker IP addresses, domains, file hashes, shell names, or malicious commands. This limits signature-based hunting and means defenders should rely primarily on version assessment and host-level behavior associated with suspicious privilege escalation.

The flaw is also notable because backup software naturally operates with elevated access. Backup integrations need permission to read large portions of the filesystem and interact with hosting-control-panel data, so weaknesses that allow an attacker to influence privileged plugin operations can have disproportionate consequences compared with vulnerabilities in ordinary user applications.

CVE-2026-87886 Mitigation

Acronis recommends immediately updating affected products to the fixed versions. Administrators of cPanel and WHM systems should install Acronis Backup plugin 1.9.3 HF3, build 1021, or later. Version 1.9.4, build 1022, is already available and incorporates the security correction.

Plesk administrators should update the Acronis Backup extension to version 1.8.11, build 638, or later. Although exploitation has not been reported against Plesk deployments, the same CVE applies and the vulnerable extension should still be updated.

CVE-2026-87886 detection should begin with an inventory of Linux hosting servers running Acronis Backup integrations. Security teams should identify the exact plugin or extension build rather than relying solely on the marketing version number.

Servers running:

• cPanel & WHM plugin versions earlier than 1.9.3.1021
• Plesk extension versions earlier than 1.8.11.638

should be treated as vulnerable and prioritized for remediation.

To Detect CVE-2026-87886 exploitation or suspicious post-compromise activity, defenders should examine Linux audit, process, authentication, filesystem, and control-panel telemetry for:

• Low-privileged hosting accounts unexpectedly spawning root-owned processes
• Privilege changes that cannot be tied to legitimate administrator activity
• Unauthorized changes to Acronis plugin or extension files
• Permission or ownership changes affecting Acronis-related files and directories
• Shells, interpreters, or system utilities launched unexpectedly by plugin-related processes
• Changes to /etc, system service configuration, cron jobs, or systemd units immediately after lower-privileged account activity
• Newly created privileged users or modified sudo configuration
• Unexpected SSH keys added to privileged accounts
• Suspicious processes launched from writable hosting-account directories
• New persistence mechanisms appearing after cPanel, WHM, or Plesk account activity
• Access to credentials, backup configuration, or other tenants’ data by accounts that normally should not have that visibility

These signals are hunting leads rather than unique exploit signatures because Acronis has not disclosed the precise vulnerable files or complete exploitation technique.

Organizations should pay particular attention to multi-tenant hosting systems where customers or resellers can obtain legitimate local accounts. In those environments, the authentication prerequisite does not necessarily represent a strong security barrier because many independent users may already have shell or application-level access to the same underlying server.

Patching should also be combined with retrospective investigation for cPanel and WHM deployments that were vulnerable before the security update. Since Acronis has confirmed real-world exploitation, installing the fixed version prevents future abuse but does not establish that an exposed system was never compromised.

If suspicious privilege escalation is discovered, incident responders should identify the original low-privileged account and determine how it was obtained. The vulnerability itself does not explain the attacker’s initial access, so remediation should include investigating compromised credentials, vulnerable websites, malicious scripts, exposed hosting accounts, or other entry points.

Security teams should also review any resources that could have been accessed after privilege escalation, including:

• Other hosted customer accounts
• Web application configuration files
• Database credentials
• cPanel/WHM or Plesk administrative credentials
• Acronis configuration and authentication material
• SSH keys
• Cloud or storage credentials
• Backup data
• API tokens and integration secrets

Potentially exposed credentials should be rotated, and affected websites or accounts should be inspected for unauthorized changes or persistence.

The CVE-2026-87886 mitigation priority is particularly high for hosting providers and MSPs because compromise of one server can affect many downstream customers. CISA’s addition of the flaw to KEV reinforces that organizations should treat vulnerable deployments as an active threat rather than a theoretical software weakness.

For federal organizations subject to CISA’s directive, remediation is required by September 19, 2026. CISA also calls for forensic triage in accordance with its risk-based vulnerability remediation guidance.