Acronis Backup plugin for cPanel, Plesk and DirectAdmin: privilege escalation flaw CVE-2026-87886 used in attacks
Acronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin have a flaw (CVE-2026-87886) that lets a logged-in user gain full control of the server. Limited attacks seen on cPanel. Hosting admins: update the plugin. Home users: nothing to do.
If you run a web hosting server with the Acronis Backup add-on, update it to cPanel & WHM plugin 1.9.3.1021 or later, Plesk extension 1.8.11.638 or later, or DirectAdmin plugin 1.2.3.238 or later. If you only buy hosting, ask your host whether they have done this.
What’s happening
CVE-2026-87886 is a privilege escalation flaw in Acronis Backup add-ons for web hosting control panels. Insecure default file permissions in the Linux components let someone who already has a low-privileged account on the server gain higher access. Acronis said it had detected limited, targeted attacks against Acronis Backup plugin deployments for cPanel & WHM, based on a report from a potentially affected customer. It reported no signs of attacks on Plesk. CISA added the flaw to its list of exploited vulnerabilities on 16 September 2026. The CVSS score is 7.8. Acronis lists fixes for the cPanel & WHM plugin (build 1.9.3.1021, described by the press as 1.9.3 HF3), the Plesk extension (1.8.11.638) and the DirectAdmin plugin (1.2.3.238). Acronis has published no indicators of compromise, and no attackers or victims have been named. The press reports did not mention DirectAdmin, so its listed fix comes from CISA's entry; the Acronis advisory page itself could not be read. It matters mainly to web hosts and businesses that run these panels.
- What
- Flaw
- Affects
- Acronis Backup plugin for cPanel & WHM, extension for Plesk, plugin for DirectAdmin
- Affected
- Acronis Backup plugin for cPanel & WHM before 1.9.3.1021
Acronis Backup extension for Plesk before 1.8.11.638
Acronis Backup plugin for DirectAdmin before 1.2.3.238 - Fixed in
- Acronis Backup plugin for cPanel & WHM 1.9.3.1021 (1.9.3 HF3)
Acronis Backup extension for Plesk 1.8.11.638
Acronis Backup plugin for DirectAdmin 1.2.3.238 - Since
- 15 Sept 2026
- Closed
- 16 Sept 2026
Timeline
- CISA added
CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalogue. Help Net Security reported that Acronis saw no signs of attacks on Plesk deployments, and that fixes were cPanel & WHM 1.9.3 HF3 and Plesk 1.8.11.
- Made publicFixed
Acronis published an update and advisory SEC-10986 for CVE-2026-87886, an incorrect default permissions flaw in its Backup plugin for cPanel & WHM and extension for Plesk. It said it had seen limited, targeted attacks against cPanel & WHM deployments.
Sources
- Acronis security advisory SEC-10986Acronis · 15 Sept 2026
- Acronis warns of actively exploited flaw in its cPanel backup pluginBleepingComputer · 16 Sept 2026
- Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)Help Net Security · 16 Sept 2026
- Acronis plugin vulnerability exploitedCyber Security News · 16 Sept 2026