CVE-2026-87886: Actively Exploited Privilege Escalation Flaw in Acronis cPanel Backup Plugin

Key facts for Acronis cPanel privilege escalation

Detection coverage for Acronis cPanel privilege escalation

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2523 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886

Detects the exploitation moment for CVE-2026-87886: a process running under a non-root, tenant-level UID invokes the Acronis Backup plugin binary/agent for cPanel & WHM or the Backup extension for Plesk, and a root-UID (0) child process is spawned from that invocation without an intervening sudo/su/setuid authentication event. Acronis confirms exploitation requires no user interaction and only an existing low-privileged local account, so the signature is the UID transition itself, not a credential prompt.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1548, T1078.003
• Data sources: auditd, linux_secure, syslog_auth, cpanel_access_log
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype=linux_secure OR sourcetype=auditd
| eval parent_uid=coalesce(auid, ppid_uid), child_uid=uid
| search (process_name="*acronis*" OR process_path="*acronis*" OR comm="*acronis*" OR process_path="*/opt/acronis/*" OR process_path="*/usr/local/cpanel/*acronis*" OR process_path="*plesk*acronis*")
| where child_uid=0 AND parent_uid!=0
| eval sudo_present=if(match(_raw, "(?i)sudo|pam_unix\(sudo|setuid attempt authorized"), "yes", "no")
| where sudo_present="no"
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(process_path) as process_path, values(host) as host, count by parent_uid, child_uid, user
| where count > 0
| sort - last_seen

Microsoft KQL

let AcronisPattern = dynamic(["acronis", "/opt/acronis/", "acronis_backup", "AcronisBackupExtension"]);
Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" or Facility == "authpriv" or ProcessName has_any (AcronisPattern) or SyslogMessage has_any (AcronisPattern)
| extend UidFrom = extract(@"uid=(\d+)", 1, SyslogMessage), UidTo = extract(@"euid=(\d+)", 1, SyslogMessage)
| where UidTo == "0" and UidFrom != "0" and UidFrom != ""
| where not(SyslogMessage has_any ("sudo:", "pam_unix(sudo"))
| project TimeGenerated, Computer, ProcessName, UidFrom, UidTo, SyslogMessage
| sort by TimeGenerated desc

Sigma

title: Acronis Backup Plugin Root Privilege Escalation (CVE-2026-87886)
id: 7a9f2e1c-4b3d-4a2e-9c7f-1e8d6b5a3c02
status: experimental
description: Detects a non-root UID triggering an Acronis Backup plugin/extension process (cPanel & WHM or Plesk) that results in a root-UID (0) child process without a preceding sudo/su authentication event, consistent with active exploitation of CVE-2026-87886.
references:
    - https://security-advisory.acronis.com/advisories/SEC-10986
    - https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1078.003
    - attack.t1068
    - cve.2026.87886
    - cwe.269
logsource:
    category: process_creation
    product: linux
detection:
    selection_process:
        Image|contains:
            - 'acronis'
            - '/opt/acronis/'
            - 'AcronisBackupExtension'
    selection_uid_transition:
        ParentUser|startswith:
            - 'u'
            - 'cptmp'
        User: 'root'
    filter_authorized:
        CommandLine|contains:
            - 'sudo'
            - 'su -'
            - 'pam_unix(sudo'
    condition: selection_process and selection_uid_transition and not filter_authorized
falsepositives:
    - Legitimate root-scheduled Acronis backup cron jobs launched directly by root (parent already UID 0, so excluded by selection_uid_transition)
    - Administrator-initiated sudo-based Acronis plugin maintenance (excluded by filter_authorized)
level: high

Known false positives:

• Root-scheduled Acronis backup cron/systemd-timer jobs where the parent process is already UID 0
• Administrator sudo-based plugin maintenance sessions that legitimately transition to root

Tuning notes: Exclude known-good root-owned parent PPIDs for the vendor's own systemd unit/cron entry once your environment's baseline is captured; add the exact Acronis package binary path/name once confirmed in your build to reduce the wildcard-match surface.

• 🔒 Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886 · unlock with TL Creds
• 🔒 Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 · unlock with TL Creds
• 🔒 Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 · unlock with TL Creds
• 🔒 Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886 · unlock with TL Creds
• 🔒 Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 · unlock with TL Creds
• 🔒 Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 · unlock with TL Creds
• 🔒 Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 · unlock with TL Creds
• 🔒 Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 · unlock with TL Creds

Indicators of compromise for Acronis cPanel privilege escalation

As of 2026-09-15, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-2523.

How Acronis cPanel privilege escalation works

On September 15, 2026, Acronis disclosed CVE-2026-87886, a local privilege escalation vulnerability (CVSS 7.8, HIGH) affecting the Acronis Backup plugin for cPanel & WHM (builds before 1.9.3.1021) and the Acronis Backup extension for Plesk (builds before 1.8.11.638). Per Acronis advisory SEC-10986, an attacker who already holds low-privileged access to a vulnerable Linux server can exploit the flaw to increase their permission level, potentially enabling them to access or modify sensitive data and disrupt the system, without any user interaction. Acronis states that exploitation has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments specifically, though the company has clarified that this assessment is based on a single report from a potentially affected customer rather than broad telemetry. Consistent with responsible-disclosure practice for an actively exploited bug, Acronis has withheld the specific technical root cause (e.g., no confirmation of a setuid/sudo misconfiguration, symlink race, or insecure IPC channel) to give administrators time to patch; no indicators of compromise, exploit code, or post-exploitation tradecraft beyond 'privilege escalation without user interaction' have been publicly disclosed as of this research.

A brief initial advisory reportedly preceded the full exploitation warning by a few days (described by BleepingComputer as having been published 'last weekend'), before Acronis expanded the advisory to confirm in-the-wild exploitation on September 15, 2026. Acronis has released fixed builds for both affected products: Backup plugin for cPanel & WHM 1.9.3 HF3, and Backup extension for Plesk 1.8.11.

This is not the first privilege-related issue in this plugin family, and the pattern is well-documented across three prior CVEs. CVE-2024-8767 (CVSS 9.9 via CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-250 Execution with Unnecessary Privileges), disclosed September 2024, affected sensitive data disclosure and manipulation due to unnecessary privileges assignment across Acronis Backup plugin for cPanel & WHM (before build 619), Backup extension for Plesk (before build 555), and Backup plugin for DirectAdmin (before build 147) -- the same three-panel product family, just not the same CVE. Separately, CVE-2024-34014 (CVSS 5.5, CWE-61 UNIX Symbolic Link (Symlink) Following, arbitrary file overwrite during recovery) and CVE-2024-34015 (CVSS 3.3, CWE-61, sensitive information disclosure during file browsing) were disclosed in November 2024 for the same cPanel & WHM plugin (and, for CVE-2024-34014, also the Plesk extension and DirectAdmin plugin), both stemming from improper symbolic-link handling exploitable by a local low-privileged attacker. The recurrence of privilege-boundary flaws in this product line is a relevant signal for defenders operating shared or reseller Linux hosting environments where backup agents commonly run with elevated (often root) privileges to back up all tenant accounts on a server -- a single low-privileged tenant compromising the backup agent's privilege boundary can have server-wide blast radius across every other hosted account. As of this research (2026-09-15), CVE-2026-87886 does not yet appear in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.09.14) or in the NVD/CVE.org record set (NVD API query returns zero results), consistent with its very recent (same-day) public disclosure; those catalogs typically lag initial vendor advisories by days to weeks.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1078.003 Local Accounts

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Impact

T1489 Service Stop; T1565.001 Stored Data Manipulation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1588.006 Vulnerabilities

Remediation for Acronis cPanel privilege escalation

Patches

• Acronis Backup plugin for cPanel & WHM 1.9.3 HF3
• Acronis Backup extension for Plesk 1.8.11

Immediate actions

• Update Acronis Backup plugin for cPanel & WHM to build 1.9.3 HF3 or later
• Update Acronis Backup extension for Plesk to build 1.8.11 or later
• Audit low-privileged, reseller, and tenant accounts on affected servers for unexpected privilege changes, new root-owned processes, or unauthorized account creation

Longer-term hardening

• Apply least-privilege design to backup-agent processes and hosting-panel plugins that require elevated access to service multiple tenants
• Monitor cPanel/WHM and Plesk hosts for unauthorized privilege escalation, unexpected root-level process execution, or backup-agent anomalies
• Subscribe to Acronis security advisories for this plugin family given its recurring history of privilege-boundary flaws (CVE-2024-8767, CVE-2024-34014, CVE-2024-34015)
• Treat backup-agent and hosting-panel plugins that run with root privileges as high-value attack surface in shared/reseller hosting threat models

Affected and fixed versions

• Acronis — Backup plugin for cPanel & WHM
  Vulnerable versions: < 1.9.3.1021
  Fixed in: 1.9.3 HF3
• Acronis — Backup extension for Plesk
  Vulnerable versions: < 1.8.11.638
  Fixed in: 1.8.11

Timeline of Acronis cPanel privilege escalation

• 2024-09-17 locked-ioc-12 discloses CVE-2024-8767 (CVSS 9.9, CWE-250), a privilege-escalation and sensitive-data-disclosure flaw in the same locked-ioc-12 Backup plugin/extension family for locked-ioc-11 (before build 619), locked-ioc-14 (before build 555), and DirectAdmin (before build 147), establishing a documented precedent of privilege-related issues in this product line.
• 2024-11-11 locked-ioc-12 discloses CVE-2024-34014 (CVSS 5.5, CWE-61, arbitrary file overwrite during recovery via improper symlink handling) and CVE-2024-34015 (CVSS 3.3, CWE-61, information disclosure via improper symlink handling) in the locked-ioc-12 Backup plugin for locked-ioc-11, extending the same product line's history of local low-privilege attacker abuse.
• 2026-09-13 locked-ioc-12 publishes an initial brief advisory for CVE-2026-87886 without full technical detail; BleepingComputer describes it as having gone out 'last weekend' relative to the September 15 exploitation warning (exact date approximate).
• 2026-09-15 As of this research, CVE-2026-87886 has not yet been added to the CISA Known Exploited Vulnerabilities catalog (checked against catalog v2026.09.14) or published in the NVD/CVE.org record set, consistent with same-day vendor disclosure.
• 2026-09-15 securityonline.info publishes independent coverage of the actively exploited locked-ioc-12 cPanel plugin flaw, corroborating the exploitation-in-the-wild warning.
• 2026-09-15 BleepingComputer publishes coverage aggregating locked-ioc-12's advisory, bringing the actively exploited flaw to broad public and security-community attention.
• 2026-09-15 locked-ioc-12 confirms patched builds are available: Backup plugin for locked-ioc-11 1.9.3 HF3 and Backup extension for locked-ioc-14 1.8.11, urging immediate update.
• 2026-09-15 locked-ioc-12 advisory SEC-10986 warns that exploitation of CVE-2026-87886 has been detected in the wild, in limited, targeted attacks against locked-ioc-12 Backup plugin for locked-ioc-11 deployments, based on a report from a single potentially affected customer.
• 2026-09-15 CVE-2026-87886 is published for the local privilege-escalation flaw in locked-ioc-12 Backup plugin for locked-ioc-11 and Backup extension for locked-ioc-14.

Sources cited for Acronis cPanel privilege escalation

• SEC-10986 - Acronis Advisory Database security-advisory.acronis.com · Advisory · 2026-09-15
• CISA Known Exploited Vulnerabilities Catalog (checked 2026-09-15, catalog v2026.09.14; CVE-2026-87886 not yet listed) CISA · Government advisory · 2026-09-15
• NVD entry check for CVE-2026-87886 (queried 2026-09-15; not yet published in NVD) NVD (NIST) · Research · 2026-09-15
• CVE-2024-8767 - Acronis Backup Linux Privilege Escalation (prior related flaw, same plugin family) cert.kenet.or.ke · Research · 2024-09-17
• CVE-2024-8767 - NVD detail (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-250) NVD (NIST) · Research · 2024-09-17
• CVE-2024-8767 detail - cvefeed.io cvefeed.io · Research · 2024-09-17
• CVE-2024-8767 detail - CVEdetails.com cvedetails.com · Research · 2024-09-17
• CVE-2024-34014 - Acronis Backup plugin symlink arbitrary file overwrite strix.ai · Research · 2024-11-11
• CVE-2024-34015 - Acronis Backup plugin symlink information disclosure strix.ai · Research · 2024-11-11
• Acronis warns of actively exploited flaw in its cPanel backup plugin BleepingComputer · News · 2026-09-15
• Acronis cPanel Plugin Flaw Exploited in the Wild, Patch Now securityonline.info · News · 2026-09-15

More in vulnerability

• TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released
• Active Exploitation of BTCPay Server Instances Draining Bitcoin Hot Wallets (Versions Older Than 2.4.2)
• Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
• Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
• Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)