CVE-2026-87886: Acronis Backup Plugin — Linux Privilege Escalation Exploited (September 2026)

CVE-2026-87886 — Acronis Backup Plugin

CVE-2026-87886 is a critical local privilege escalation vulnerability affecting Acronis backup plugins for cPanel and WHM on Linux. The flaw is under active exploitation in targeted attacks, allowing authenticated attackers to gain elevated privileges on vulnerable servers. No exploitation has been observed on Plesk deployments as of this report.

Attack Vector

Attackers require authenticated access to a Linux server running the vulnerable Acronis backup plugin for cPanel or WHM. By leveraging the flaw, they can escalate their privileges from a standard user to root, potentially compromising backup integrity and the broader server environment. The attack is local; remote exploitation is not indicated. No specific IOCs have been published, but privilege escalation attempts by non-root users should be scrutinized.

Who Is at Risk

Organizations running Acronis backup plugins on cPanel or WHM-managed Linux servers are at immediate risk. Acronis is the confirmed affected vendor. Plesk deployments are not currently impacted. Environments with shared hosting or multiple user accounts are especially vulnerable to insider or lateral movement attacks.

Patch & Mitigate

• Patch: Apply the latest security update from Acronis for the backup plugin on cPanel and WHM immediately. Check vendor advisories for version specifics and deadlines.
• Workaround: Restrict plugin access to trusted users until patched. Limit SSH and panel access to essential personnel.
• Detect: Monitor logs for unusual privilege escalation events, especially sudo or su activity from non-administrative accounts. Review backup plugin logs for unexpected access patterns.

MITRE ATT&CK

• TA0004 — Privilege Escalation: The vulnerability directly enables attackers to elevate privileges on Linux systems.
• TA0005 — Defense Evasion: Attackers may use elevated privileges to disable security controls or tamper with backup processes.

Source: https://www.helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886/