{"id":"acronis-backup-plugin-privilege-escalation-sep-2026","category":"patch","status":"closed","title":"Acronis Backup plugin for cPanel, Plesk and DirectAdmin: privilege escalation flaw CVE-2026-87886 used in attacks","tldr":"Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin have a flaw (CVE-2026-87886) that lets a logged-in user gain full control of the server. Limited attacks seen on cPanel. Hosting admins: update the plugin. Home users: nothing to do.","summary":"CVE-2026-87886 is a privilege escalation flaw in Acronis Backup add-ons for web hosting control panels. Insecure default file permissions in the Linux components let someone who already has a low-privileged account on the server gain higher access. Acronis said it had detected limited, targeted attacks against Acronis Backup plugin deployments for cPanel & WHM, based on a report from a potentially affected customer. It reported no signs of attacks on Plesk. CISA added the flaw to its list of exploited vulnerabilities on 16 September 2026. The CVSS score is 7.8. Acronis lists fixes for the cPanel & WHM plugin (build 1.9.3.1021, described by the press as 1.9.3 HF3), the Plesk extension (1.8.11.638) and the DirectAdmin plugin (1.2.3.238). Acronis has published no indicators of compromise, and no attackers or victims have been named. The press reports did not mention DirectAdmin, so its listed fix comes from CISA's entry; the Acronis advisory page itself could not be read. It matters mainly to web hosts and businesses that run these panels.","action":"If you run a web hosting server with the Acronis Backup add-on, update it to cPanel & WHM plugin 1.9.3.1021 or later, Plesk extension 1.8.11.638 or later, or DirectAdmin plugin 1.2.3.238 or later. If you only buy hosting, ask your host whether they have done this.","product":"Acronis Backup plugin for cPanel & WHM, extension for Plesk, plugin for DirectAdmin","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-87886"],"tags":["acronis","cpanel","plesk","directadmin","privilege-escalation","kev","web-hosting"],"affected":["Acronis Backup plugin for cPanel & WHM before 1.9.3.1021","Acronis Backup extension for Plesk before 1.8.11.638","Acronis Backup plugin for DirectAdmin before 1.2.3.238"],"fixed":["Acronis Backup plugin for cPanel & WHM 1.9.3.1021 (1.9.3 HF3)","Acronis Backup extension for Plesk 1.8.11.638","Acronis Backup plugin for DirectAdmin 1.2.3.238"],"matches":[],"sources":[{"kind":"advisory","title":"Acronis security advisory SEC-10986","url":"https://security-advisory.acronis.com/advisories/SEC-10986","by":"Acronis","date":"2026-09-15"},{"kind":"news","title":"Acronis warns of actively exploited flaw in its cPanel backup plugin","url":"https://bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin","by":"BleepingComputer","date":"2026-09-16"},{"kind":"news","title":"Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)","url":"https://helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886","by":"Help Net Security","date":"2026-09-16"},{"kind":"news","title":"Acronis plugin vulnerability exploited","url":"https://cybersecuritynews.com/acronis-plugin-vulnerability-exploited/","by":"Cyber Security News","date":"2026-09-16"}],"started":"2026-09-15","closed":"2026-09-16","created":"2026-11-03T22:08:47.661Z","updated":"2026-11-03T22:08:47.661Z","cve_notes":[{"cve":"CVE-2026-87886","name":"Incorrect default permissions in Acronis Backup plugins","what":"Insecure default file permissions in Acronis Backup add-ons for cPanel & WHM, Plesk and DirectAdmin let someone with a low-privileged account on the server gain higher privileges and control of the machine.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-09-16","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalogue. Help Net Security reported that Acronis saw no signs of attacks on Plesk deployments, and that fixes were cPanel & WHM 1.9.3 HF3 and Plesk 1.8.11.","url":"https://helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886","by":"Help Net Security","patch":null},{"at":"2026-09-15","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"Acronis published an update and advisory SEC-10986 for CVE-2026-87886, an incorrect default permissions flaw in its Backup plugin for cPanel & WHM and extension for Plesk. It said it had seen limited, targeted attacks against cPanel & WHM deployments.","url":"https://bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin","by":"BleepingComputer","patch":"patched"}],"url":"https://hard.fyi/live/acronis-backup-plugin-privilege-escalation-sep-2026/","json":"https://hard.fyi/api/live?id=acronis-backup-plugin-privilege-escalation-sep-2026"}