Acronis warns of actively exploited flaw in its cPanel backup plugin
Acronis reports CVE-2026-87886, a CVSS 7.8 Linux privilege escalation in its cPanel/WHM and Plesk backup plugins, exploited in limited targeted attacks.
CVE-2026-87886 is a high-severity local privilege escalation flaw in Acronis Backup plugin for cPanel & WHM (fixed in 1.9.3 HF3) and the Plesk extension (fixed in 1.8.11). A low-privileged attacker can elevate permissions on a vulnerable Linux server to access or modify sensitive data without user interaction. Acronis says it detected exploitation in the wild in limited, targeted attacks based on a single customer report, with no IOCs published yet.
- CVE-2026-87886 scores 7.8 and allows Linux local privilege escalation without user interaction
- Exploitation detected in limited, targeted attacks against cPanel & WHM deployments
- Fixed in cPanel plugin 1.9.3 HF3 and Plesk extension 1.8.11
- No indicators of compromise disclosed; technical details withheld to allow patching
- CVEs
- CVE-2026-87886
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87886 | Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.