Acronis cPanel Backup Plugin Flaw Exploited in Targeted Attacks to Gain Elevated Linux Privileges

Tracked as CVE-2026-87886, the vulnerability carries a CVSS score of 7.8 and results from insecure file permissions within affected Acronis backup integrations.

Successful exploitation could allow an attacker who already has low-level access to a vulnerable Linux server to elevate their privileges, potentially enabling unauthorized actions or arbitrary code execution with significantly greater permissions.

The vulnerability also affects the Acronis Backup extension for Plesk on Linux, although currently available reporting indicates that observed in-the-wild exploitation has specifically targeted cPanel & WHM environments.

CVE-2026-87886 at a Glance

The vulnerability is particularly important for hosting companies and managed service providers because cPanel, WHM and Plesk are commonly deployed on servers hosting multiple customer websites and workloads.

Which Acronis Products Are Affected?

Two Acronis integrations are affected:

Acronis released Backup plugin for cPanel & WHM 1.9.3 HF3, build 1021, on September 11, 2026 specifically containing the security fix. Version 1.9.4, build 1022, was also released the same day and is newer.

Administrators should therefore update to the latest supported version, rather than simply remaining on the minimum fixed release.

How the Vulnerability Works

Acronis has intentionally not released detailed exploitation information, but the company identifies the underlying weakness as insecure file permissions.

The vulnerability requires an attacker to already possess some level of local access to the Linux server.

A simplified attack scenario is:

Attacker obtains low-privileged access
↓
Vulnerable Acronis Backup plugin identified
↓
Insecure file permissions abused
↓
CVE-2026-87886 triggered
↓
Privileges elevated
↓
Attacker gains greater control over server
↓
Potential arbitrary code execution or unauthorized actions

This distinction is important: CVE-2026-87886 is not an unauthenticated remote-code-execution vulnerability by itself.

An attacker needs an initial foothold before using the flaw for privilege escalation.

Why Privilege Escalation Is Dangerous on Hosting Servers

Although CVE-2026-87886 requires prior access, privilege-escalation vulnerabilities can dramatically increase the impact of an initial compromise.

An attacker may first compromise a low-privileged hosting account through an unrelated vulnerability, stolen credentials, malicious web application or compromised customer website.

CVE-2026-87886 could then potentially help that attacker move from restricted access toward significantly higher privileges.

On a shared hosting environment, elevated server privileges could potentially expose far more than the originally compromised website.

Depending on the server configuration and privileges ultimately obtained, the attacker could attempt to access:

• Other hosted websites
• Website configuration files
• Database credentials
• Backup data
• Email accounts
• API credentials
• TLS certificates and private keys
• Hosting configuration
• Customer information
• Authentication secrets

The vulnerability therefore becomes particularly important when combined with another weakness that provides the initial server foothold.

Acronis Confirms Targeted Exploitation

Acronis says it has detected exploitation of CVE-2026-87886 in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments.

However, several important details remain unknown.

Acronis has not publicly identified:

• The threat actor responsible
• How attackers obtained their initial low-privileged access
• When exploitation first began
• Which organizations were targeted
• What attackers did after privilege escalation
• Whether malware or persistent backdoors were installed

There is also currently no public evidence in the reviewed reporting of exploitation targeting the affected Plesk extension.

Administrators should therefore avoid assuming that every vulnerable deployment has been compromised while still treating the confirmed exploitation as justification for urgent remediation.

CISA Adds the Flaw to Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026 following evidence of real-world exploitation.

Federal Civilian Executive Branch agencies were instructed to remediate the vulnerability by September 19, 2026.

Inclusion in KEV reinforces that the vulnerability is not simply theoretical and should receive elevated patching priority.

Why cPanel and WHM Environments Are Attractive Targets

Hosting servers are valuable targets because a single machine may support numerous websites, databases, mailboxes and customer accounts.

A compromise of one website does not necessarily provide control over the entire server because hosting environments normally use permission boundaries to separate customers and services.

Privilege-escalation vulnerabilities threaten those boundaries.

An attack could conceptually follow this broader pattern:

Vulnerable website or stolen hosting credentials

→ Low-privileged server foothold

→ CVE-2026-87886 privilege escalation

→ Higher server privileges

→ Access to additional resources

→ Persistence, credential theft or further compromise

This makes local privilege-escalation vulnerabilities valuable components of multi-stage attacks even when they cannot provide initial remote access on their own.

What Administrators Should Investigate

Because exploitation has already been observed, administrators should not stop after installing the patch.

Servers that previously ran vulnerable versions should be reviewed for evidence that an attacker may already have obtained access.

Security teams should investigate:

• Unexpected changes to Acronis plugin files or permissions
• Suspicious privilege-escalation activity
• Unexpected processes running with elevated privileges
• Recently created privileged users
• Unauthorized SSH keys
• Unusual sudo activity
• Changes to /etc/passwd or /etc/shadow
• Suspicious cron jobs
• Modified systemd services
• Unexpected binaries in temporary directories
• Recently modified web application files
• PHP or other web shells
• Unexplained outbound network connections
• Unauthorized access to backup data

Administrators should correlate Acronis-related activity with authentication, SSH, web server, cPanel and operating-system logs to identify the potential initial entry point.

Patching Does Not Remove an Existing Compromise

Installing the latest Acronis version closes the known vulnerability, but it does not automatically remove persistence established before the update.

If an attacker successfully escalated privileges, they could potentially have created another mechanism for maintaining access.

This might include additional accounts, SSH keys, scheduled jobs, modified services, web shells or other malware.

Organizations that find evidence of exploitation should therefore conduct a broader incident-response investigation rather than considering the server secure immediately after patching.

Immediate Actions for Administrators

Acronis customers running affected Linux hosting environments should:

• Update the Acronis Backup plugin for cPanel & WHM immediately.
• Update the Acronis Backup extension for Plesk.
• Prefer the latest supported release rather than only the minimum fixed build.
• Inventory all hosting servers running Acronis integrations.
• Review historical authentication and privilege-escalation activity.
• Examine file permissions and unexpected changes to Acronis components.
• Audit privileged accounts and SSH keys.
• Review cron jobs and systemd services for unauthorized persistence.
• Investigate suspicious outbound connections.
• Examine hosted websites for the initial compromise vector.
• Rotate sensitive credentials if compromise is confirmed.
• Consider rebuilding heavily compromised servers from known-clean sources when system integrity cannot be established.

Hosting providers should also check development, staging and older servers that may have been overlooked during routine patch deployment.

Security Takeaway

CVE-2026-87886 demonstrates why local privilege-escalation vulnerabilities should not be dismissed simply because attackers require an initial foothold.

In a hosting environment, an attacker may first compromise a low-privileged website or customer account and then search for vulnerabilities that allow them to break out of those restrictions.

A flaw affecting backup software is particularly concerning because backup platforms frequently operate with elevated permissions and interact with large amounts of sensitive data.

Acronis has already confirmed limited, targeted exploitation, and CISA has placed the vulnerability in its Known Exploited Vulnerabilities catalog.

Organizations running Acronis Backup integrations on Linux should therefore patch immediately and investigate previously vulnerable cPanel & WHM systems for signs of compromise.