Full Report
Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions - Acronis Backup plugin for cPanel & WHM (Linux
Analysis Summary
# Vulnerability: Acronis Backup Plugin Local Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-87886
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-281 (Insecure Permissions) / CWE-732 (Incorrect Permission Assignment for Critical Resource)
## Affected Systems
- **Products:**
- Acronis Backup plugin for cPanel & WHM (Linux)
- Acronis Backup extension for Plesk (Linux)
- **Versions:**
- Acronis Backup plugin for cPanel & WHM: Versions prior to build 1.9.3.1021
- Acronis Backup extension for Plesk: Versions prior to build 1.8.11.638
- **Configurations:** Linux-based deployments of cPanel, WHM, and Plesk utilizing the Acronis backup integration.
## Vulnerability Description
The vulnerability stems from **insecure file permissions** within the Acronis Backup plugin/extension. This flaw allows a local user with low-level privileges to manipulate files or execute unauthorized actions that lead to **Local Privilege Escalation (LPE)**. By exploiting these weak permissions, an attacker can elevate their access levels to that of a more privileged user (such as root), potentially gaining full control over the host system.
## Exploitation
- **Status:** Exploited in the wild (Limited, targeted attacks detected).
- **Complexity:** Low (Insecure file permissions are generally trivial to exploit once identified).
- **Attack Vector:** Local (The attacker must already have initial access to the system, such as a low-privileged shell or a compromised web user).
## Impact
- **Confidentiality:** High (Potential unauthorized access to all data on the server, including backups).
- **Integrity:** High (Ability to modify system files, configurations, and application code).
- **Availability:** High (Potential to delete backups or disable system services).
## Remediation
### Patches
Acronis has released updates to address this flaw. Administrators should upgrade to the following builds immediately:
- **cPanel & WHM:** Update to **build 1.9.3.1021** (Fixed in 1.9.3 HF3).
- **Plesk:** Update to **build 1.8.11.638**.
### Workarounds
No specific official workarounds (such as manual permission hardening) have been provided; the vendor recommends immediate patching due to active exploitation.
## Detection
- **Indicators of Compromise:** Look for unusual binary executions originating from the cPanel/Plesk backup directories, or unauthorized modifications to system-level files by web-service users.
- **Detection methods and tools:** Audit file permissions for the Acronis plugin directory. Monitor system logs for unauthorized use of `sudo` or elevation attempts tied to the Acronis plugin service.
## References
- **Vendor Advisory:** hxxps://security-advisory.acronis[.]com/advisories/SEC-10986
- **Update Link (cPanel):** hxxps://security-advisory.acronis[.]com/updates/UPD-2609-3d72-20a7
- **Update Link (Plesk):** hxxps://security-advisory.acronis[.]com/updates/UPD-2609-efb0-50b2
- **News Source:** hxxps://thehackernews[.]com/2026/09/acronis-cpanel-backup-plugin.html