CVE-2026-87886: Actively Exploited Privilege Escalation Flaw in Acronis cPanel Backup Plugin

CVE-2026-87886 (TL-2026-2523) is a high-severity software vulnerability scored CVSS 7.8, first published 2026-09-15. It has no confirmed attribution, affects Acronis Backup plugin for cPanel & WHM, references 1 CVE (CVE-2026-87886), maps to 8 MITRE ATT&CK techniques (T1005, T1078.003, T1082), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-2523

Threat ID
TL-2026-2523
Severity
HIGH
CVSS
7.8
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-15
Last reviewed
2026-09-15
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
15

Acronis warns that CVE-2026-87886, a high-severity (CVSS 7.8) local privilege escalation flaw in its Backup plugin for cPanel & WHM and Backup extension for Plesk, is being actively exploited in limited, targeted attacks. A low-privileged attacker with an existing account on a vulnerable Linux server can escalate privileges without user interaction; Acronis has shipped patched builds for both products.

How CVE-2026-87886 works

On September 15, 2026, Acronis disclosed CVE-2026-87886, a local privilege escalation vulnerability (CVSS 7.8, HIGH) affecting the Acronis Backup plugin for cPanel & WHM (builds before 1.9.3.1021) and the Acronis Backup extension for Plesk (builds before 1.8.11.638). Per Acronis advisory SEC-10986, an attacker who already holds low-privileged access to a vulnerable Linux server can exploit the flaw to increase their permission level, potentially enabling them to access or modify sensitive data and disrupt the system, without any user interaction. Acronis states that exploitation has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments specifically, though the company has clarified that this assessment is based on a single report from a potentially affected customer rather than broad telemetry. Consistent with responsible-disclosure practice for an actively exploited bug, Acronis has withheld the specific technical root cause (e.g., no confirmation of a setuid/sudo misconfiguration, symlink race, or insecure IPC channel) to give administrators time to patch; no indicators of compromise, exploit code, or post-exploitation tradecraft beyond 'privilege escalation without user interaction' have been publicly disclosed as of this research.

A brief initial advisory reportedly preceded the full exploitation warning by a few days (described by BleepingComputer as having been published 'last weekend'), before Acronis expanded the advisory to confirm in-the-wild exploitation on September 15, 2026. Acronis has released fixed builds for both affected products: Backup plugin for cPanel & WHM 1.9.3 HF3, and Backup extension for Plesk 1.8.11.

This is not the first privilege-related issue in this plugin family, and the pattern is well-documented across three prior CVEs. CVE-2024-8767 (CVSS 9.9 via CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-250 Execution with Unnecessary Privileges), disclosed September 2024, affected sensitive data disclosure and manipulation due to unnecessary privileges assignment across Acronis Backup plugin for cPanel & WHM (before build 619), Backup extension for Plesk (before build 555), and Backup plugin for DirectAdmin (before build 147) -- the same three-panel product family, just not the same CVE. Separately, CVE-2024-34014 (CVSS 5.5, CWE-61 UNIX Symbolic Link (Symlink) Following, arbitrary file overwrite during recovery) and CVE-2024-34015 (CVSS 3.3, CWE-61, sensitive information disclosure during file browsing) were disclosed in November 2024 for the same cPanel & WHM plugin (and, for CVE-2024-34014, also the Plesk extension and DirectAdmin plugin), both stemming from improper symbolic-link handling exploitable by a local low-privileged attacker. The recurrence of privilege-boundary flaws in this product line is a relevant signal for defenders operating shared or reseller Linux hosting environments where backup agents commonly run with elevated (often root) privileges to back up all tenant accounts on a server -- a single low-privileged tenant compromising the backup agent's privilege boundary can have server-wide blast radius across every other hosted account. As of this research (2026-09-15), CVE-2026-87886 does not yet appear in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.09.14) or in the NVD/CVE.org record set (NVD API query returns zero results), consistent with its very recent (same-day) public disclosure; those catalogs typically lag initial vendor advisories by days to weeks.

MITRE ATT&CK techniques used in TL-2026-2523

Collection

T1005 Data from Local System

Initial Access

T1078.003 Local Accounts

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Impact

T1489 Service Stop; T1565.001 Stored Data Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1588.006 Vulnerabilities

Affected products and versions in CVE-2026-87886

  • Acronis — Backup plugin for cPanel & WHM
    Vulnerable versions: < 1.9.3.1021
    Fixed in: 1.9.3 HF3
  • Acronis — Backup extension for Plesk
    Vulnerable versions: < 1.8.11.638
    Fixed in: 1.8.11

Remediation for CVE-2026-87886

Patches

  • Acronis Backup plugin for cPanel & WHM 1.9.3 HF3
  • Acronis Backup extension for Plesk 1.8.11

Immediate actions

  • Update Acronis Backup plugin for cPanel & WHM to build 1.9.3 HF3 or later
  • Update Acronis Backup extension for Plesk to build 1.8.11 or later
  • Audit low-privileged, reseller, and tenant accounts on affected servers for unexpected privilege changes, new root-owned processes, or unauthorized account creation

Longer-term hardening

  • Apply least-privilege design to backup-agent processes and hosting-panel plugins that require elevated access to service multiple tenants
  • Monitor cPanel/WHM and Plesk hosts for unauthorized privilege escalation, unexpected root-level process execution, or backup-agent anomalies
  • Subscribe to Acronis security advisories for this plugin family given its recurring history of privilege-boundary flaws (CVE-2024-8767, CVE-2024-34014, CVE-2024-34015)
  • Treat backup-agent and hosting-panel plugins that run with root privileges as high-value attack surface in shared/reseller hosting threat models

CVEs associated with CVE-2026-87886

CVE-2026-87886

Weaknesses (CWE) in CVE-2026-87886

CWE-269

Timeline of CVE-2026-87886

  • Acronis discloses CVE-2024-8767 (CVSS 9.9, CWE-250), a privilege-escalation and sensitive-data-disclosure flaw in the same Acronis Backup plugin/extension family for cPanel & WHM (before build 619), Plesk (before build 555), and DirectAdmin (before build 147), establishing a documented precedent of privilege-related issues in this product line.
  • Acronis discloses CVE-2024-34014 (CVSS 5.5, CWE-61, arbitrary file overwrite during recovery via improper symlink handling) and CVE-2024-34015 (CVSS 3.3, CWE-61, information disclosure via improper symlink handling) in the Acronis Backup plugin for cPanel & WHM, extending the same product line's history of local low-privilege attacker abuse.
  • Acronis publishes an initial brief advisory for CVE-2026-87886 without full technical detail; BleepingComputer describes it as having gone out 'last weekend' relative to the September 15 exploitation warning (exact date approximate).
  • As of this research, CVE-2026-87886 has not yet been added to the CISA Known Exploited Vulnerabilities catalog (checked against catalog v2026.09.14) or published in the NVD/CVE.org record set, consistent with same-day vendor disclosure.
  • securityonline.info publishes independent coverage of the actively exploited Acronis cPanel plugin flaw, corroborating the exploitation-in-the-wild warning.
  • BleepingComputer publishes coverage aggregating Acronis's advisory, bringing the actively exploited flaw to broad public and security-community attention.
  • Acronis confirms patched builds are available: Backup plugin for cPanel & WHM 1.9.3 HF3 and Backup extension for Plesk 1.8.11, urging immediate update.
  • Acronis advisory SEC-10986 warns that exploitation of CVE-2026-87886 has been detected in the wild, in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments, based on a report from a single potentially affected customer.
  • CVE-2026-87886 is published for the local privilege-escalation flaw in Acronis Backup plugin for cPanel & WHM and Backup extension for Plesk.

Sources cited for CVE-2026-87886

More in vulnerability

Detection coverage for TL-2026-2523

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2523 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats