CVE-2026-87886 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-09-17

Added to CISA KEV: 2026-09-16 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is in the CISA KEV catalog — active exploitation is confirmed. Treat patching as an emergency priority, particularly in shared hosting environments.
PATCH IMMEDIATELY: Update Acronis Backup plugin for cPanel/WHM to build 1.9.3.1021 or later, Acronis Backup extension for Plesk to build 1.8.11.638 or later, and Acronis Backup plugin for DirectAdmin to build 1.2.3.238 or later.
INCIDENT RESPONSE: Review system logs for unexpected privilege escalation events, new root-level processes, unexpected cron jobs, SUID binary modifications, or unauthorized SSH keys added to root's authorized_keys. Check for signs of lateral movement to other tenants.
AUDIT FILE PERMISSIONS: Run permission audits on Acronis Backup plugin installation directories and associated binaries. Look for world-writable files or directories owned by privileged users.
COMPENSATING CONTROLS (if patching is delayed): Restrict shell access to the server to only necessary accounts. Audit and minimise the number of local OS users on the affected host. Consider disabling the Acronis Backup plugin/extension until patched.
MONITOR: Deploy file integrity monitoring (FIM) on plugin directories and privileged binary paths. Alert on unexpected modifications to files in Acronis Backup installation paths.
REVIEW ACCESS LOGS: In shared hosting environments, audit all user shell sessions for the period since the CVE publication date (September 2026). Flag any sessions by accounts that do not normally use shell access.
PATCH PRIORITY: CRITICAL — CISA KEV status mandates urgent remediation. US federal agencies should comply with BOD 22-01 timelines. All hosting providers running affected plugins should treat this as P1.

🔍 Web Intelligence (Kagi · 2026-09-17)

Summary

CVE-2026-87886 is a critical local privilege escalation vulnerability (CVSS score 9.5) affecting the Acronis Backup plugins for cPanel/WHM and the Acronis Backup extension for Plesk. The flaw stems from insecure default file permissions (CWE-276), which allows authenticated low-privileged users on a shared hosting or multi-tenant server to hijack processes or manipulate files to execute commands with root privileges. This vulnerability is highly significant because it facilitates full system compromise in environments where multiple users share the same infrastructure, making it a priority target for threat actors.

Exploitation

Active Exploitation: CISA has officially confirmed that CVE-2026-87886 is currently being exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog ^[2]^[4].
Threat Actors: While specific campaign names are still being documented, the vulnerability is being actively leveraged in multi-tenant hosting environments to escalate privileges ^[1].
PoC/Tool Availability: Public technical dossiers and exploitation methodologies exist detailing how to perform root execution hijacking via this insecure permission flaw ^[1].
Attack Prerequisites:

* Access: Local access is required; the attacker must be an authenticated user on the host system. * User Interaction: No specific user interaction from an administrator is required; the vulnerability is triggered by exploiting the weak permissions natively.

Affected Products & Patches

Affected Products: Acronis Backup plugins for cPanel & WHM, and the Acronis Backup extension for Plesk ^[3]^[5].
Patch Availability: Acronis has released security updates to address this vulnerability; administrators are strongly urged to update their plugins/extensions immediately to the patched versions ^[3].
Mitigations: In environments where patching is delayed, administrators should restrict access to the server or disable the affected plugin/extension until updates are applied ^[2].

Impact

Capabilities: Successful exploitation grants a low-privileged user the ability to escalate their access to root, providing full control over the underlying server and all hosted data.
Business Risk: For internet-facing deployments—particularly web hosting providers—this vulnerability poses a catastrophic risk. An attacker could compromise the entire server infrastructure, potentially affecting all tenants hosted on that machine, leading to massive data theft, service disruption, and complete loss of server integrity.

Sources

CVE-2026-87886: Local Privilege Escalation via Insecure Permissions in ...
Authoritative technical security dossier on CVE-2026-87886 in Acronis Backup plugins for cPanel/WHM and Plesk: insecure file permissions (CWE-276), root execution hijacking, CISA KEV exploitation in multi-tenant hosting, Sigma rules, and forensic triage.
CVE-2026-87886: Acronis Backup cPanel & Plesk Privilege Escalation ...
CISA confirms active exploitation of CVE-2026-87886 in Acronis Backup plugins for cPanel/WHM and Plesk. Hosting providers and shared-server operators must patch now.
Acronis Patches Exploited Vulnerability in cPanel Backup Plugin
Acronis has patched CVE-2026-87886, an exploited privilege escalation vulnerability in the Backup plugin for cPanel & WHM.
CVE-2026-87886 · Acronis · CVSS 9.5 · CISA KEV · CVE Brief Analyst Report
CVE-2026-87886 9.5 CISA KEV Acronis · Backup Acronis Backup plugins for cPanel and Plesk contain an insecure file permissions vulnerability that allows authenticated users to perform local privilege escalation. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (confirmed active exploitation) Aff…
CVE-2026-87886: Acronis Backup Incorrect Default Permissions ...
CVE-2026-87886 is an incorrect default permissions issue in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Weak file or directory permissions can let a lower-privileged user gain higher privileges on the host.

🟢 CVE-2026-87886