CVE-2026-87886

Published Sep 17, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-87886 is a local privilege escalation vulnerability found in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk on Linux systems. This flaw stems from insecure file permissions, which allows authenticated attackers or low-privileged local users to elevate their privileges on a vulnerable server without requiring user interaction. Acronis has confirmed that this vulnerability has been exploited in the wild through limited, targeted attacks specifically against deployments of the Acronis Backup plugin for cPanel & WHM. The company has released security updates to address the issue, advising administrators to install the latest versions of the affected plugins.

Description: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Source: security@acronis.com
NVD status: Analyzed
Products: acronis_backup

Risk scores

CVSS 3.0

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Acronis Backup Incorrect Default Permissions Vulnerability
Exploit added on: Sep 16, 2026
Exploit action due: Sep 19, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

security@acronis.com: CWE-276

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*",
            "matchCriteriaId": "4CB8B9F6-DAB7-4F21-B2B4-0EE01347AC1E",
            "versionEndExcluding": "1.2.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*",
            "matchCriteriaId": "AEA7BEC1-B14B-4ED9-8FA8-D602D612BCA2",
            "versionEndExcluding": "1.8.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*",
            "matchCriteriaId": "1F03983F-EC1E-4831-BF34-69331B521543",
            "versionEndExcluding": "1.9.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*",
            "matchCriteriaId": "61BB35F9-D0AB-484A-8C9F-BA79DD51916B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*",
            "matchCriteriaId": "C9442FB3-3ECF-49D7-9940-41F296D7D0BC",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*",
            "matchCriteriaId": "E892B84E-B369-4E1A-B9B6-57FBD1F96AFC",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.