Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel & WHM backup plugin already exploited in targeted attacks.
Acronis released an urgent update for CVE-2026-87886 (CVSS 7.8), an insecure file permissions issue (CWE-276) in its Backup plugin for cPanel & WHM that lets a low-privileged local user elevate privileges on Linux servers. The company confirmed exploitation in limited, targeted attacks against cPanel & WHM deployments; the Plesk extension is also affected but no exploitation was observed there. Fixes are version 1.9.3 HF3 (build 1.9.3.1021 or later) for cPanel & WHM and 1.8.11 (build 1.8.11.638 or later) for Plesk.
- CVE-2026-87886 (CVSS 7.8, CWE-276) insecure file permissions allow local low-privileged attackers to escalate on Linux.
- Exploited in limited targeted attacks against cPanel & WHM deployments; no Plesk exploitation observed.
- Fixed in plugin build 1.9.3.1021 (1.9.3 HF3) and Plesk extension 1.8.11.638.
- Exploitation requires a prior foothold, making shared hosting and multi-tenant environments especially concerning.
- CVEs
- CVE-2026-87886
- Organizations
- Acronis
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87886 | Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at gbhackers.com
Acronis has released an urgent security update for a high-severity local privilege escalation vulnerability affecting its Backup plugin for cPanel & WHM on Linux. The company confirmed that attackers have already exploited this flaw in limited, targeted attacks against vulnerable deployments. This vulnerability is tracked as CVE-2026-87886 and is described as an insecure file permissions […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.