Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)
Acronis warns CVE-2026-87886, an authenticated Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugins, is under limited targeted exploitation; patches released.
Acronis disclosed CVE-2026-87886, a privilege escalation vulnerability caused by insecure file permissions in its backup plugins for cPanel, WHM, and Plesk, platforms popular among hosting providers and MSPs. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments, with no exploitation observed on Plesk so far, and the low-complexity attack requires no user interaction. Fixes shipped last week: backup plugin version 1.9.3 HF3 for cPanel & WHM and extension version 1.8.11 for Plesk.
- Authenticated attackers gain local privilege escalation via insecure file permissions
- Exploitation confirmed in the wild against cPanel & WHM deployments only
- Low-complexity attack requires no user interaction
- Fixed versions: cPanel & WHM plugin 1.9.3 HF3, Plesk extension 1.8.11
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87886 | NVD description · AI analysis pending | — | — | — | — | — |
Full article289 words · extracted from helpnetsecurity.com · click to collapse
A Linux privilege escalation vulnerability (CVE-2026-87886) affecting Acronis’ backup extensions for cPanel, WebHost Manager (WHM), and Plesk, is being leveraged by attackers, the backup and recovery company warns.
“Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments,” Acronis said in the security advisory published on Tuesday.
There’s currently no signs of its active exploitation on Plesk deployments.
What the backup plugins do
Acronis is a cybersecurity and data protection technology company that’s popular among web hosting providers and managed service providers, since its platform lets them offer backup and security to their clients under their own branding.
Acronis’ backup add-ons link cPanel & WHM and Plesk – control panel platforms that make managing web servers and websites easier through a graphical interface – to Acronis’ cloud infrastructure, allowing administrators to back up and recover sites, databases, mailboxes, etc.
What to do
CVE-2026-87886 stems from insecure file permissions and allows authenticated attackers to achieve local privilege escalation without any user interaction.
The vulnerability’s CVSS string indicates that it can be exploited in low complexity attacks, i.e., the attack doesn’t require special conditions or circumstances beyond the attacker’s control to succeed.
Though Acronis pushed out security updates for the vulnerable backup plugins last week, it has yet to disclose details about the in-the-wild attacks. Thus, we don’t know what the attackers are doing once they escalate their privileges on vulnerable Linux servers.
Acronis has advised administrators to immediately install:
- Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3
- Acronis Backup extension for Plesk version 1.8.11
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886/