High severity7.8CISA KEVNVD Advisory· Published Sep 17, 2026· Updated Sep 18, 2026
CVE-2026-87886
CVE-2026-87886
Description
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*+ 5 more
- cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*range: <1.9.3
- cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*range: <1.2.3
- cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*range: <1.8.11
- cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*
- cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*
- cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*
- Range: <1.9.3.1021
- Range: <1.8.11.638
- Range: <1.2.3.238
Patches
Vulnerability mechanics
References
2- security-advisory.acronis.com/advisories/SEC-10986nvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
6- Week in review: Cisco patches exploited email gateway 0-day, Revolut breachHelp Net Security · Sep 20, 2026
- Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted AttacksThe Hacker News · Sep 16, 2026
- Acronis Patches Exploited Vulnerability in cPanel Backup PluginSecurityWeek · Sep 16, 2026
- Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)Help Net Security · Sep 16, 2026
- Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the WildCyber Security News · Sep 16, 2026
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts