Story · 2 sources · 2 articlesfirst Sep 16, 09:52 UTCupdated Sep 16, 09:57 UTC (11d ago)

Acronis Patches Exploited Linux Privilege Escalation Flaw (CVE-2026-87886) in cPanel/Plesk Backup Plugins; CISA Adds It to KEV Catalog

criticalExploit / PoCexploited in the wildimportance 80CVE-2026-76460 CVE-2026-87886 CVE-2026-58704

What's new: First merged summary for this story. On September 16, 2026, Acronis disclosed and patched CVE-2026-87886 and confirmed limited, targeted in-the-wild exploitation against cPanel & WHM deployments. On September 17, 2026, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, triggering BOD 22-01 remediation deadlines for federal agencies.

Merged summary · glm-5.3 · rewritten as coverage arrives

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), an insecure file permissions flaw enabling local privilege escalation on Linux in its Backup plugin for cPanel & WHM and Backup extension for Plesk; exploitation was observed in limited, targeted attacks…

Acronis disclosed and patched CVE-2026-87886 (CVSS 7.8, CWE-276), a local privilege escalation vulnerability caused by insecure file permissions in its Backup plugin for cPanel & WHM and Backup extension for Plesk on Linux. A low-privileged local attacker with a prior foothold could escalate permissions and potentially run arbitrary code, affecting the confidentiality and integrity of the application; Security Affairs characterizes the impact as local root-level code execution, while other reports describe it as privilege escalation with potential arbitrary code execution. Affected products are cPanel & WHM plugin builds before 1.9.3.1021 (fixed in version 1.9.3 HF3) and Plesk extension builds before 1.8.11.638; Acronis urges immediate updates. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments only, with no exploitation observed against the Plesk extension. Acronis has not identified the attackers, timing, or objectives, and has withheld technical details. On September 17, 2026, Security Affairs reported that CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog alongside CVE-2026-76460 (CVSS 10.0, unauthenticated API authentication bypass in Cisco ISE, confirmed actively exploited) and CVE-2026-58704 (CVSS 8.8, Google Pixel cellular modem permission bypass patched in the September 2026 Pixel update); under BOD 22-01, U.S. federal agencies must remediate KEV entries by the stated due dates, and private organizations are urged to review the catalog. GBHackers notes that because exploitation requires a prior foothold, shared hosting and multi-tenant environments are especially concerning.

CVE-2026-87886 (CVSS 7.8, CWE-276): insecure file permissions allow a low-privileged local attacker to escalate privileges on Linux servers.
Affected: cPanel & WHM Backup plugin Linux builds before 1.9.3.1021 (fixed in 1.9.3 HF3) and Plesk Backup extension builds before 1.8.11.638 (fixed in 1.8.11).
Exploitation confirmed in limited, targeted attacks against cPanel & WHM deployments only; no exploitation observed against the Plesk extension.
Acronis has not identified the attackers, timing, or objectives, and has withheld technical details.
Sources disagree on impact severity: The Hacker News reports privilege escalation with potential arbitrary code execution affecting confidentiality and integrity; Security Affairs describes local root-level code execution.

VendorsCisco Acronis Google cPanel Plesk

ProductsCisco Identity Services Engine Acronis Backup Google Pixel Acronis Backup plugin for cPanel & WHM Backup extension for Plesk Acronis Backup extension for Plesk

OrganizationsCISA Acronis

Coverage timelineoldest first · each row is one article

Sep 16, 09:52 UTC · 11d ago
SecurityWeek· 72
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.
Sep 16, 09:57 UTC · 11d ago
GBHackers· 62
Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges
Acronis patched CVE-2026-87886 (CVSS 7.8), a local privilege escalation flaw in its cPanel & WHM backup plugin already exploited in targeted attacks.

Vulnerabilities in this storyAll →

CVE-2026-587048.8<1%
Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation
published 11d ago· Google Cellular Modem (modem firmware on Google Pixel-class devices, per assigning CNA) KEV
CVE-2026-7646010.0

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-58704	Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA (dsap-vuln-management@google.com), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments. Do: Install the latest Google monthly security update that includes the cellular modem firmware patch and verify the device's security patch level reflects it. Because exploitation requires network adjacency plus some existing privilege, prioritize devices used in high-risk or shared-network settings and watch for indicators of rogue femtocell/base-station or hostile local-network activity. With no public PoC or KEV listing, standard monthly patch cadence is reasonable outside those high-risk scenarios.	8.8	<1%	KEV	Google Cellular Modem (modem firmware on Google Pixel-class devices, per assigning CNA)	masstens of millions of devices (≈10M+ active Pixel-class handsets worldwide)	11d ago KEV Sep 16, 2026
CVE-2026-76460	Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending. Do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface.	10.0	14%	KEV PoC
CVE-2026-87886	Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation CVE-2026-87886 is an incorrect default permissions flaw (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Because files or objects installed by the plugin/extension carry overly permissive default permissions, a local attacker with low-privileged access to a Linux hosting server can abuse them to escalate privileges. Successful exploitation grants elevated Linux privileges on the hosting server, which could enable persistence, access to hosted customer data, or further lateral movement. Any hosting provider or administrator running the Acronis Backup integration on cPanel & WHM or Plesk servers is affected. The flaw was added to the CISA KEV catalog on 2026-09-16, and multiple reports describe targeted attacks exploiting it in the wild, though no public proof-of-concept is known and ransomware use is undetermined. Do: Upgrade the Acronis Backup plugin for cPanel & WHM and the Plesk extension to the latest versions specified in Acronis's security advisory, since fixed version numbers are not provided in the available data. Audit affected Linux hosting servers for signs of local privilege escalation (unexpected setuid/permission changes, new privileged accounts, unusual cron or service activity), and restrict low-privileged shell access to the server where possible. As the flaw is on CISA's KEV list, federal and BOD 26-04-bound stakeholders must apply vendor mitigations on internet-exposed and high-risk assets on an accelerated timeline.	7.8	<1%	KEV	Acronis Backup plugin for cPanel & WHM

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-58704

Permission Bypass in Google Pixel Cellular Modem Allows Proximal Privilege Escalation

A logic error in the cellular modem component causes an improper authorization check (CWE-285/CWE-693), allowing a permission bypass. An attacker who already has low privileges and is on an adjacent network (proximal, e.g., a hostile local or cellular-adjacent network) can trigger the flaw without any user interaction, and successful exploitation yields remote escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.0). The flaw was assigned through Google's device security CNA (dsap-vuln-management@google.com), consistent with modem firmware shipped in Google Pixel-class devices; specific affected firmware versions were not provided in the source data. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and there is no evidence of exploitation in the wild. Defenders should treat this as a patch-on-next-bulletin item unless devices operate in high-risk adjacent-network environments.

Do: Install the latest Google monthly security update that includes the cellular modem firmware patch and verify the device's security patch level reflects it. Because exploitation requires network adjacency plus some existing privilege, prioritize devices used in high-risk or shared-network settings and watch for indicators of rogue femtocell/base-station or hostile local-network activity. With no public PoC or KEV listing, standard monthly patch cadence is reasonable outside those high-risk scenarios.

8.8

<1%

KEV

Google Cellular Modem (modem firmware on Google Pixel-class devices, per assigning CNA)

masstens of millions of devices (≈10M+ active Pixel-class handsets worldwide)

11d ago

KEV Sep 16, 2026

CVE-2026-76460

Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC

Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs flaw (CWE-648) affecting the web-based management interface. An unauthenticated, remote attacker with network access to that interface can send requests that invoke privileged APIs without authenticating, bypassing the interface's access controls. Successful exploitation grants the attacker unauthorized access to the affected device, presumably with the administrative capabilities available through the management interface, such as control over network access policy and visibility into identity data. Any organization running an affected Cisco ISE or ISE-PIC release is potentially affected, with risk highest where the management interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16, indicating exploitation in the wild, though no public proof-of-concept is known and CVSS scoring is pending.

Do: Upgrade ISE and ISE-PIC to the fixed releases specified in Cisco's security advisory (fixed versions are not provided in the available data); because the flaw is on CISA's KEV list, federal agencies must patch or apply mitigations per BOD 26-04 timelines. Until patched, restrict access to the web-based management interface to trusted administrative networks only, verify no unintended exposure via firewalls/ACLs, and monitor for unauthenticated access attempts against the interface.

10.0

14%

KEV PoC

CVE-2026-87886

Incorrect Default Permissions in Acronis Backup Plugin for cPanel & WHM and Plesk Enable Privilege Escalation

CVE-2026-87886 is an incorrect default permissions flaw (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Because files or objects installed by the plugin/extension carry overly permissive default permissions, a local attacker with low-privileged access to a Linux hosting server can abuse them to escalate privileges. Successful exploitation grants elevated Linux privileges on the hosting server, which could enable persistence, access to hosted customer data, or further lateral movement. Any hosting provider or administrator running the Acronis Backup integration on cPanel & WHM or Plesk servers is affected. The flaw was added to the CISA KEV catalog on 2026-09-16, and multiple reports describe targeted attacks exploiting it in the wild, though no public proof-of-concept is known and ransomware use is undetermined.

Do: Upgrade the Acronis Backup plugin for cPanel & WHM and the Plesk extension to the latest versions specified in Acronis's security advisory, since fixed version numbers are not provided in the available data. Audit affected Linux hosting servers for signs of local privilege escalation (unexpected setuid/permission changes, new privileged accounts, unusual cron or service activity), and restrict low-privileged shell access to the server where possible. As the flaw is on CISA's KEV list, federal and BOD 26-04-bound stakeholders must apply vendor mitigations on internet-exposed and high-risk assets on an accelerated timeline.

7.8

<1%

KEV

Acronis Backup plugin for cPanel & WHM