CVE-2026-87886
published 2026-09-17CVE-2026-87886: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build…
PriorityP181high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-09-19
Exploited in the wild
EPSS
0.23%
13.4th percentile
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| acronis | acronis_backup | < 1.2.3 | 1.2.3 |
| acronis | acronis_backup | < 1.8.11 | 1.8.11 |
| acronis | acronis_backup | < 1.9.3 | 1.9.3 |
| acronis | acronis_backup | — | — |
| acronis | acronis_backup | — | — |
| acronis | acronis_backup | — | — |
| acronis | acronis_backup_extension_for_plesk | >= unspecified < 1.8.11.638 | 1.8.11.638 |
| acronis | acronis_backup_plugin_for_cpanel_whm | >= unspecified < 1.9.3.1021 | 1.9.3.1021 |
| acronis | acronis_backup_plugin_for_directadmin | >= unspecified < 1.2.3.238 | 1.2.3.238 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Acronis Backup Plugin permission
vuldb·2026-09-18·CVSS 7.8
CVE-2026-87886 [HIGH] Acronis Backup Plugin permission
A vulnerability was found in Acronis Backup Plugin, Acronis Backup Extension and Acronis Backup Plugin. It has been classified as very critical. Affected is an unknown function. Performing a manipulation results in permission issues.
This vulnerability is reported as CVE-2026-87886. The attack requires a local approach. No exploit exists.
GHSA
Local privilege escalation due to insecure file permissions.
ghsa_unreviewed·2026-09-18
CVE-2026-87886 [HIGH] CWE-276 Local privilege escalation due to insecure file permissions.
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
VulnCheck
Acronis Backup Incorrect Default Permissions Vulnerability
vulncheck·2026
CVE-2026-87886 CWE-276 Acronis Backup Incorrect Default Permissions Vulnerability
Acronis Backup Incorrect Default Permissions Vulnerability
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Affected: Acronis Backup
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Exploitation References: https://security-ad
CISA
Acronis Backup Incorrect Default Permissions Vulnerability
cisa·2026-09-16
CVE-2026-87886 CWE-276 Acronis Backup Incorrect Default Permissions Vulnerability
Vulnerability: Acronis Backup Incorrect Default Permissions Vulnerability
Affected: Acronis Backup
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://security-adviso
No detection rules found.
No public exploits indexed.
2026-09-17
Published
2026-09-16
Added to CISA KEV
Exploited in the wild