Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis warns CVE-2026-87886, a local privilege escalation flaw in its cPanel/WHM and Plesk backup plugins, is exploited in targeted attacks.
65
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenAug 28, 2026
- Last mentionedSep 16, 2026
Timeline
6 articles · newest firstAcronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel & WHM backup plugin already exploited in targeted attacks.
62
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.
72
Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)
Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.
72
Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel and Plesk backup plugins, exploited in targeted attacks.
65
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
68
Related CVEs
by mentions- CVE-2026-87886<1%7.8Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation
- CVE-2026-4817218%10.0Privilege Escalation (Possible Root) in LiteSpeed cPanel Plugin
- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2026-544201%8.5Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild
- CVE-2026-58048<1%9.4Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context
- CVE-2026-65643<1%8.7Authenticated eval injection in cPanel enables root code execution
- CVE-2026-58047<1%5.6HTTP Smuggling in cPanel allows potential leak of credentials
Appears with
- cPanelvendor · 6
- Acronisvendor · 5
- Acronis Backup plugin for cPanel & WHMproduct · 5
- Acronis Backup extension for Pleskproduct · 4
- Acronisorganization · 2
- Phusion Passengervendor · 1
- cPanel & WHMproduct · 1
- CloudLinuxvendor · 1
- LiteSpeedvendor · 1
- WebProsvendor · 1
- CISAorganization · 1
- Help Net Securityorganization · 1
- Backup extension for Pleskproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.