CVE-2026-87886
Known exploited · CISA KEV
CVSS 7.8 HIGH: local privilege escalation due to insecure file permissions. EPSS 0.2% (13th percentile).
CISA federal remediation date Sep 19
Vulnerabilities · 42 days ago
Acronis says CVE-2026-87886 in its Backup plugin for cPanel & WHM has been exploited in limited, targeted attacks, and the same file-permission flaw also affects the Linux Backup extension for Plesk. The vendor has already shipped fixes for both plugins, but only the cPanel & WHM side has confirmed in-the-wild abuse so far.
The bug is a local privilege-escalation issue: a low-privileged user can tamper with a file or path the backup service expects to trust, and the service later runs that content with higher rights. On a shared hosting server, that can turn one tenant-level foothold into host-level root and put backup data, restore paths, and the panel’s control plane within reach.
For web hosts and MSPs, the important boundary is the server, not the add-on. If Acronis sits on a multi-tenant node, a compromise of the panel layer can spill across customer sites on that same machine, and the Plesk reporting leaves one piece unresolved: the flaw is patched there, but vendor-observed exploitation has not been seen.
Known exploited · CISA KEV
CVSS 7.8 HIGH: local privilege escalation due to insecure file permissions. EPSS 0.2% (13th percentile).
CISA federal remediation date Sep 19
5 sources covering this story
Acronis: rilevato sfruttamento in rete della CVE-2026-87886
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-87886 – già sanata dal vendor – che interessa i plugin di backup Acronis per Plesk, cPanel e WHM.
Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis says CVE-2026-87886, a local privilege escalation flaw in its Linux backup plugins, was exploited in limited targeted attacks.
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.
Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886) - Help Net Security
A Linux privilege escalation vulnerability (CVE-2026-87886) in Acronis' backup extensions for cPanel & WHM is being exploited.
Acronis warns of actively exploited flaw in its cPanel backup plugin
Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild.
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel patched CVE-2026-67401, which lets a hosting account with mail privileges create files anywhere and run code as root.
Part of the PlainSec briefing for 2026-09-17