CVE-2026-87886

This vulnerability is a “permissions” problem: part of the Acronis backup add-on can be made accessible in a way that lets a low-level local user take over a Linux server. Think of it like leaving a back door key in the lockbox, where someone with limited access could use it to open (and control) the whole building. Since it’s been used in real attacks (at least against the cPanel & WHM plugin), it’s important to update.

This matters if you run Linux servers with the Acronis Backup plugin for cPanel & WHM, the Acronis Backup extension for Plesk, or the Acronis Backup plugin for DirectAdmin and you are on builds older than the fixed versions listed. The weakness requires local low-level access on the server, meaning it’s typically relevant when an attacker already has some foothold (for example, a compromised user account).

Reachability gate: it becomes a risk when a local low-privileged user can access a Linux server running an affected Acronis backup add-on build (before the fixed versions).

This is RED because it is confirmed in CISA KEV and exploitation has been reported in the wild in limited, targeted attacks against the Acronis Backup plugin for cPanel & WHM. The CISA remediation due date is 2026-09-19, so you should treat this as an urgent patching project. Even though it requires local low-level access, attackers commonly reach that stage after an initial compromise, making timely upgrades critical.

1. Inventory what’s installed:

   • Identify whether each server has: (a) Acronis Backup plugin for cPanel & WHM, (b) Acronis Backup extension for Plesk, and/or (c) Acronis Backup plugin for DirectAdmin.
   • Record the exact build number for each installed Acronis component.

2. Determine if you’re affected (based on build ranges):

   • cPanel & WHM plugin: affected if earlier than build 1.9.3.1021.
   • Plesk extension: affected if earlier than build 1.8.11.638.
   • DirectAdmin plugin: affected if earlier than build 1.2.3.238.

3. Upgrade to fixed versions (per component):

   • Upgrade the cPanel & WHM plugin to 1.9.3.1021.
   • Upgrade the Plesk extension to 1.8.11.638.
   • Upgrade the DirectAdmin plugin to 1.2.3.238.

4. Validate after upgrading:

   • Confirm the plugin/extension still works with your hosting control panel.
   • Check that the expected Acronis management functions load and backups run as normal.

5. If you cannot upgrade immediately (temporary containment):

   • Because the issue is local privilege escalation tied to the add-on’s components, reduce the chance of an attacker obtaining a low-privileged account in the first place: enforce strong account security (password hygiene/MFA where available), review recent logins, and restrict or harden account access in the control panel environment.
   • Follow the vendor’s mitigations guidance if provided; CISA guidance indicates prioritizing security updates based on risk and ensuring compliance with CISA’s BOD 26-04, and to discontinue use if mitigations aren’t available.

6. Forensics/monitoring focus (especially for cPanel & WHM deployments):

   • Look for signs of privilege changes after an account compromise.
   • Look for unexpected edits to system and add-on files, suspicious deletions, and unusual process activity around the time of any detected compromise.

CISA timing note:

• CISA KEV remediation due date: 2026-09-19. Start upgrades immediately and prioritize cPanel & WHM servers given the reported targeted exploitation.

Severity is HIGH (CVSS 7.8) with a RED operational verdict. The weakness is CWE-276 (insecure file permissions) leading to local privilege escalation: an attacker with local low-level access can escalate to take complete ownership of the server environment by reading/modifying/deleting critical system data via the vulnerable Acronis backup management add-on. Attack vector is characterized as Network in the findings, but exploitation still requires local low-level access (authentication required; no user interaction). Exploitation status: listed in CISA KEV (added 2026-09-16) and reported exploited in the wild in limited, targeted attacks against the Acronis Backup plugin for cPanel & WHM; no active exploitation reported for the Plesk extension. No public exploit code is on record. EPSS details are not provided in the supplied findings, so exploitation confidence comes from KEV/news rather than prediction. KEV indicates CISA has high confidence that the vulnerability is exploited or poses an active risk, and it includes specific CISA due-date and response expectations (BOD 26-04 and related triage/forensics guidance).