Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel and Plesk backup plugins, exploited in targeted attacks.
Acronis released fixes for CVE-2026-87886 (CVSS 7.8, CWE-276), an insecure file permissions flaw in Linux-based backup components for cPanel & WHM and Plesk that enables local privilege escalation. The vendor observed limited, targeted exploitation in the wild before patches shipped. Fixes are available in Backup plugin for cPanel & WHM 1.9.3 HF3 and Backup extension for Plesk 1.8.11. A local attacker with low privileges could gain elevated access to backup data, control panels, and other customer accounts on shared hosting infrastructure.
- Exploitation detected in limited, targeted attacks before patch availability
- Local low-privilege attacker can escalate privileges without user interaction
- Fixes: cPanel plugin 1.9.3 HF3 and Plesk extension 1.8.11
- Hosting providers and MSPs urged to prioritize patching due to multi-tenant risk
- Review auth logs, web-shell detections, and Acronis file modifications
- CVEs
- CVE-2026-87886
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87886 | Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
Acronis has released security updates for its Backup plugin for cPanel & WHM and Backup extension for Plesk after detecting limited, targeted exploitation of a high-severity local privilege-escalation vulnerability in the wild. Tracked as CVE-2026-87886, the flaw stems from insecure file permissions in the Linux-based Acronis backup components. Acronis assigned the issue a CVSS score […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.