An Acronis Backup vulnerability has moved from a patching concern to an active security threat. CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog on Sept. 16 after the flaw was confirmed under active exploitation.
Acronis said it observed limited, targeted attacks involving its Backup plugin for cPanel & WHM. The high-severity flaw can allow a low-privileged local user to gain additional privileges on affected Linux systems, putting hosting providers, managed service providers, and administrators of vulnerable deployments at risk.
CISA’s Known Exploited Vulnerabilities catalog gives covered federal civilian agencies until Sept. 19, 2026, to remediate the flaw. The action follows other recent KEV additions involving enterprise infrastructure, including active exploitation of a critical GitLab flaw.
How CVE-2026-87886 works
CVE-2026-87886 stems from insecure file permissions and is a local privilege-escalation vulnerability, not an unauthenticated remote-code-execution flaw. An attacker must already have low-privileged local access to an affected system before using the vulnerability to elevate privileges.
The flaw carries a CVSS 3.0 score of 7.8. Its CVSS metrics and vulnerability details specify a local attack vector, low attack complexity, low privileges required, and no user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
The current CVE-2026-87886 record lists three affected Linux integrations: Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021, Acronis Backup extension for Plesk before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin before build 1.2.3.238.
Acronis specifically reported attacks involving cPanel & WHM deployments in its security advisory. Public evidence does not establish active exploitation of all three integrations, and Acronis has not disclosed the attackers, initial-access method, or campaign-specific indicators of compromise.
Privilege-boundary flaws can carry broader consequences in shared environments. Recent research into the Januscape Linux VM escape vulnerability similarly showed how breaking isolation in multi-tenant infrastructure can expose resources beyond an initially compromised workload.
How organizations should respond
Organizations should identify vulnerable Acronis deployments and upgrade them to fixed builds or later supported versions. Systems exposed before patching should also be investigated because installing an update cannot determine whether exploitation occurred earlier, a concern also seen with the recently exploited Adobe Commerce zero-day.
Security teams should:
- Patch and verify affected systems. Update vulnerable Acronis integrations and confirm corrected builds are deployed across managed hosts.
- Strengthen detection and logging. Review authentication, account, process, and privilege activity for anomalies, and preserve critical logs centrally where possible.
- Reduce unnecessary access. Restrict unneeded local accounts and shell access, apply least privilege, and strengthen administrative authentication.
- Limit the potential blast radius. Segment shared hosting systems from sensitive management and internal networks where practical.
- Validate recovery and protect credentials. Test critical backups and restoration procedures, and rotate privileged credentials or secrets if compromise is suspected.
- Test incident response plans. Exercise procedures for system isolation, forensic triage, evidence preservation, credential rotation, recovery, and stakeholder notification.
The extent of the attacks remains undisclosed. Organizations that ran affected builds should pair rapid patching with a review for unauthorized privilege changes or other signs of compromise.
Let us teach you How to Talk to AI for free! Try our six-minute course at The Neuron Academy and learn a few simple ways to write better prompts and get more useful results from AI, or browse our other AI course for free for seven days. Check out all the lessons here →