Acronis Patches Exploited Linux Privilege Escalation Flaw (CVE-2026-87886) in cPanel/Plesk Backup Plugins; CISA Adds It to KEV Catalog

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), an insecure file permissions flaw enabling local privilege escalation on Linux in its Backup plugin for cPanel & WHM and Backup extension for Plesk; exploitation was observed in limited, targeted attacks…

Acronis disclosed and patched CVE-2026-87886 (CVSS 7.8, CWE-276), a local privilege escalation vulnerability caused by insecure file permissions in its Backup plugin for cPanel & WHM and Backup extension for Plesk on Linux. A low-privileged local attacker with a prior foothold could escalate permissions and potentially run arbitrary code, affecting the confidentiality and integrity of the application; Security Affairs characterizes the impact as local root-level code execution, while other reports describe it as privilege escalation with potential arbitrary code execution. Affected products are cPanel & WHM plugin builds before 1.9.3.1021 (fixed in version 1.9.3 HF3) and Plesk extension builds before 1.8.11.638; Acronis urges immediate updates. Exploitation has been detected in the wild in limited, targeted attacks against cPanel & WHM deployments only, with no exploitation observed against the Plesk extension. Acronis has not identified the attackers, timing, or objectives, and has withheld technical details. On September 17, 2026, Security Affairs reported that CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog alongside CVE-2026-76460 (CVSS 10.0, unauthenticated API authentication bypass in Cisco ISE, confirmed actively exploited) and CVE-2026-58704 (CVSS 8.8, Google Pixel cellular modem permission bypass patched in the September 2026 Pixel update); under BOD 22-01, U.S. federal agencies must remediate KEV entries by the stated due dates, and private organizations are urged to review the catalog. GBHackers notes that because exploitation requires a prior foothold, shared hosting and multi-tenant environments are especially concerning.