Vulnerabilities & Exploits · Misconfiguration

Acronis Backup flaw reaches host-level risk

Acronis says CVE-2026-87886 in its Backup plugin for cPanel & WHM has been exploited in limited, targeted attacks, and the same file-permission flaw also affects the Linux Backup extension for Plesk. The vendor has already shipped fixes for both plugins, but only the cPanel & WHM side has confirmed in-the-wild abuse so far.

The bug is a local privilege-escalation issue: a low-privileged user can tamper with a file or path the backup service expects to trust, and the service later runs that content with higher rights. On a shared hosting server, that can turn one tenant-level foothold into host-level root and put backup data, restore paths, and the panel’s control plane within reach.

For web hosts and MSPs, the important boundary is the server, not the add-on. If Acronis sits on a multi-tenant node, a compromise of the panel layer can spill across customer sites on that same machine, and the Plesk reporting leaves one piece unresolved: the flaw is patched there, but vendor-observed exploitation has not been seen.

5 sources · Sep 16

CVE-2026-87886

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: local privilege escalation due to insecure file permissions. EPSS 0.2% (13th percentile).

CISA federal remediation date Sep 19

Timeline

Sep 19 CISA federal deadline for CVE-2026-87886
Sep 16 Reported by CSIRT Italia / ACN
Sep 16 Reported by BleepingComputer

Sources

Sep 16 CSIRT Italia / ACN
Acronis: rilevato sfruttamento in rete della CVE-2026-87886
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-87886 – già sanata dal vendor – che interessa i plugin di backup Acronis per Plesk, cPanel e WHM.
original
Sep 16 The Hacker News
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis says CVE-2026-87886, a local privilege escalation flaw in its Linux backup plugins, was exploited in limited targeted attacks.
original
Sep 16 SecurityWeek
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.
original

Part of the PlainSec briefing for 2026-09-10

Every edition of this story: Acronis Backup flaw reaches host-level risk

More from today

Vulnerabilities & Exploits · MisconfigurationAcronis Backup flaw reaches host-level riskAcronis says CVE-2026-87886 in its Backup plugin for cPanel & WHM has been exploited in limited, targeted attacks, and the same file-permission flaw also affects the Linux Backup extension for Plesk. The vendor has already shipped fixes for both plugins, but only the cPanel & WHM side has confirmed in-the-wild abuse so far.The bug is a local privilege-escalation issue: a low-privileged user can tamper with a file or path the backup service expects to trust, and the service later runs that content with higher rights. On a shared hosting server, that can turn one tenant-level foothold into host-level root and put backup data, restore paths, and the panel’s control plane within reach.For web hosts and MSPs, the important boundary is the server, not the add-on. If Acronis sits on a multi-tenant node, a compromise of the panel layer can spill across customer sites on that same machine, and the Plesk reporting leaves one piece unresolved: the flaw is patched there, but vendor-observed exploitation has not been seen.5 sources · Sep 16

CVE-2026-87886

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: local privilege escalation due to insecure file permissions. EPSS 0.2% (13th percentile).

CISA federal remediation date Sep 19

Timeline

Sep 19 CISA federal deadline for CVE-2026-87886

Sep 16 Reported by CSIRT Italia / ACN

Sep 16 Reported by BleepingComputer

Sources

Sep 16 CSIRT Italia / ACN

Acronis: rilevato sfruttamento in rete della CVE-2026-87886

Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-87886 – già sanata dal vendor – che interessa i plugin di backup Acronis per Plesk, cPanel e WHM.

original

Sep 16 The Hacker News

Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

Acronis says CVE-2026-87886, a local privilege escalation flaw in its Linux backup plugins, was exploited in limited targeted attacks.

original

Sep 16 SecurityWeek

Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.

original

Part of the PlainSec briefing for 2026-09-10Every edition of this story: Acronis Backup flaw reaches host-level riskMore from today

BlueMoon spreads beyond Violet Typhoon

Check Point VPN flaws move into exploitation window

LiteLLM default key exposed gateway admin access