Acronis cPanel Backup Plugin Flaw CVE-2026-87886 Exploited; CISA Gives Agencies 3 Days

What Happened

Acronis published advisory SEC-10986 on 15 September for a local privilege escalationPrivilege Escalation🛡️An attack technique where an adversary gains elevated access rights beyond what was initially granted. flaw in the Linux backup integrations it ships for hosting control panels. The bug is now tracked as CVE-2026-87886 and classified as CWE-276, incorrect default permissions. An attacker who already holds a low-privileged account on the server can tamper with content that the plugin's privileged operations consume, and end up running code with the plugin's elevated rights.

The advisory states that exploitation "has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments." Acronis has not observed the same activity against its Plesk extension. According to BleepingComputer, that assessment rests on a single report from a potentially affected customer, and Acronis is withholding the technical specifics so administrators have time to patch before the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. sequence becomes public. No indicators of compromise have been released.

CISA added the CVE to the Known Exploited Vulnerabilities catalog on 16 September, in the same batch as the Cisco ISE zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patch, giving developers 'zero days' to fix it. CVE-2026-76460 covered here yesterday. The due date for federal civilian agencies is 19 September, a three-day window. The KEV entry marks the vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. as requiring forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs. under BOD 26-04BOD 26-04🛡️CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier., which means agencies must check for prior compromise, not just apply the update. Known ransomware campaign use is listed as unknown.

Who Is Affected

The CVE record, published by Acronis as the CNA on 17 September, lists three affected products, all Linux:

| Product | Vulnerable | Fixed build | |---|---|---| | Acronis Backup plugin for cPanel & WHM | before 1.9.3.1021 | 1.9.3 HF3, build 1021 (also 1.9.4, build 1022) | | Acronis Backup extension for Plesk | before 1.8.11.638 | 1.8.11, build 638 | | Acronis Backup plugin for DirectAdmin | before 1.2.3.238 | 1.2.3.238 |

The fixed cPanel build shipped on 11 September, four days before the advisory. Its release note is blunt: the update "contains fixes for 1 high-severity security vulnerability and should be installed immediately by all users." Note that the CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines. entry names only the cPanel & WHM plugin and the Plesk extension. The DirectAdmin plugin appears in the CVE record but not in the catalog, so DirectAdmin operators should treat themselves as in scope regardless of what the catalog says.

The population at risk is hosting providers, managed service providers, and any organisation that runs cPanel, Plesk, or DirectAdmin to serve multiple customers from one box. The integration gives the WHM administrator scheduled whole-server backups to cloud or local storage, and gives individual cPanel users self-service restoration of their own files, databases, mailboxes, and mail filters. That design puts the plugin exactly on the boundary between untrusted tenants and root-level backup operations.

Technical Analysis

The CVSS 3.0 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scoring 7.8. Local attack vector and low privileges required are what keep the score below critical, and on a dedicated server those conditions are a meaningful barrier. On a shared host they are not. Low-privileged local access is the default state of every customer account. An attacker gets it by compromising one tenant's outdated WordPress install and dropping a web shellWeb Shell🛡️A malicious script placed in a web server's content directory that lets an attacker execute commands through HTTP requests. Web shells are a common persistence mechanism after remote code execution and are detected by looking for unexpected files in webapp directories., by phishingPhishing🛡️A social engineering attack using fake emails or websites to steal login credentials or personal info. one set of cPanel credentials, or by signing up for a hosting plan with a stolen card. From there, the "local" prerequisite is satisfied.

CWE-276 covers files or directories created with permissions broader than the design intended. The dangerous configuration is a path that an unprivileged user can write to, but that a privileged process later reads, executes, or otherwise trusts. Acronis has not published the vulnerable path or the exploit sequence. The general shape of the bug class is well understood, and it is worth knowing why insecure file permissions let a low-privileged user become root, because the same pattern keeps recurring in agents that run as root on multi-user systems.

Backup software is the worst place for this pattern to show up. To back up a server, the agent must be able to read every file on it, so it runs with the highest privileges on the box. It also holds credentials to wherever the backups go. A tenant who reaches the plugin's privilege level has crossed from one customer's account to the whole server, every other customer's data, the control panel's configuration, and potentially the backup storage behind it. That is the argument for why backup agents deserve the same scrutiny as domain controllers, and it applies far beyond this one product.

Because Acronis has released no indicators, defenders are in the position of hunting for compromise before the vendor publishes indicators. The useful signals are behavioural rather than signature-based, and they are listed below.

Immediate Actions

1. **Inventory by build, not version.** Identify every Linux host running any of the three integrations, including staging, migration, and decommissioned-but-still-powered systems. Record the exact build number. A version label of 1.9.3 does not tell you whether HF3 is installed.
2. **Update to the fixed build** and confirm the plugin's service is actually running the new code afterwards. Restart the relevant services if the update did not do so. The fix has been available since 11 September for cPanel.
3. **Treat cPanel & WHM hosts as possibly compromised.** Confirmed exploitation is limited to that platform so far. Review activity going back at least to early September. Look for low-privileged hosting accounts spawning root-owned processes, permission or ownership changes in Acronis-related directories, new privileged users, changes to sudo configuration, unexpected SSH keys in privileged accounts, new cron entries or systemd units following tenant activity, and processes launched from writable hosting-account directories.
4. **If you find any of that, rotate secrets.** Control panel administrative credentials, database credentials in site configuration files, the Acronis configuration and authentication material, SSH keys, cloud storage credentials, and API tokens are all in reach of an attacker who reached root. The existing guide on how to rotate every secret after a server compromise lays out the order.
5. **Reduce tenant capability while you investigate.** Limiting shell access on multi-tenant hosts removes the easiest route to a local attack. Longer term, this is the moment to work through how to harden a shared hosting server against local privilege escalation, because the next privileged plugin with a permissions bug is a matter of time.
6. **Plesk and DirectAdmin operators should patch on the same timeline.** No exploitation has been reported against them, but the fix is identical in kind and the exploit details will circulate once Acronis lifts its embargo.

Long-Term Outlook

This is the second KEV entry in a single day tied to privileged infrastructure rather than an internet-facing service. The Cisco ISE flaw is a remote bypass; this one is local. What they share is that the compromised component is trusted by everything around it. CISA giving both the same three-day deadline is a statement about impact, not exploitability.

Expect a public technical write-up and proof-of-concept once patch adoption climbs. Acronis has said it is holding details back deliberately, which is defensible in the short term but means the window for the Plesk and DirectAdmin variants will open later, not never. Hosting providers who have patched cPanel but deferred Plesk should not assume the lack of reported exploitation will hold.

The broader lesson is about local vulnerabilities on multi-tenant systems. A CVSS score built around "attacker must be local" undercounts the risk on any server where being local costs five dollars. Providers that already treat every tenant as hostile were largely protected here by design. Those that rely on the panel and its plugins to enforce the boundary have just been shown where that boundary is thinnest.

Sources

• CISA Known Exploited Vulnerabilities feed, entry CVE-2026-87886: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, 16 September 2026: https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CVE record CVE-2026-87886 (Acronis CNA): https://cveawg.mitre.org/api/cve/CVE-2026-87886
• Acronis advisory SEC-10986: https://security-advisory.acronis.com/advisories/SEC-10986
• BleepingComputer: https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
• Help Net Security: https://www.helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886/
• SecurityWeek: https://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/
• The Hacker News: https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
• SOC Prime: https://socprime.com/blog/cve-2026-87886-acronis-backu-plugin-flaw-exploited/
• LinuxSecurity: https://linuxsecurity.com/news/security-vulnerabilities/acronis-backup-linux-hosting-flaw
• Acronis cPanel & WHM integration overview: https://www.acronis.com/en/integrations/cpanel/