CVE-2026-87886: listed in the CISA KEV catalog

CVE-2026-87886 · CVSS 7.8 HIGH · EPSS <1% · KEV 2026-09-16 · patch available

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Is CVE-2026-87886 exploited?

• Listed in the CISA KEV catalog on 2026-09-16.
• Federal remediation due 2026-09-19.
• Past that date by 40 days.
• EPSS puts exploitation in the next 30 days at <1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Acronis · Acronis Backup plugin for cPanel & WHM · < 1.9.3.1021
• Acronis · Acronis Backup extension for Plesk · < 1.8.11.638
• Acronis · Acronis Backup plugin for DirectAdmin · < 1.2.3.238

Is there a patch?

Yes. Update to one of these or later:

From Acronis's CVE record · Acronis advisory

What PlainSec published about CVE-2026-87886

• Acronis Backup flaw reaches host-level risk (2026-09-17)

Primary sources

• NVD record
• CISA KEV catalog
• Acronis advisory

KEV and EPSS are re-checked daily. Record last updated 2026-10-04.