# CVE-2026-87886: Actively Exploited Privilege Escalation Flaw in Acronis cPanel Backup Plugin

> Acronis warns that CVE-2026-87886, a high-severity (CVSS 7.8) local privilege escalation flaw in its Backup plugin for cPanel & WHM and Backup extension for Plesk, is being actively exploited in limited, targeted attacks. A low-privileged attacker with an existing account on a vulnerable Linux server can escalate privileges without user interaction; Acronis has shipped patched builds for both products.

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2523
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-acronis-cpanel-privilege-escalation-tl-2026-2523.webp?v=3130ee78 (Threadlinqs threat intel: CVE-2026-87886 Acronis cPanel Privesc: Detection & IOCs (TL-2026-2523) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-2523
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-87886, CVE-2024-34014, CVE-2024-34015, CVE-2024-8767

## Description

On September 15, 2026, Acronis disclosed CVE-2026-87886, a local privilege escalation vulnerability (CVSS 7.8, HIGH) affecting the Acronis Backup plugin for cPanel & WHM (builds before 1.9.3.1021) and the Acronis Backup extension for Plesk (builds before 1.8.11.638). Per Acronis advisory SEC-10986, an attacker who already holds low-privileged access to a vulnerable Linux server can exploit the flaw to increase their permission level, potentially enabling them to access or modify sensitive data and disrupt the system, without any user interaction. Acronis states that exploitation has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments specifically, though the company has clarified that this assessment is based on a single report from a potentially affected customer rather than broad telemetry. Consistent with responsible-disclosure practice for an actively exploited bug, Acronis has withheld the specific technical root cause (e.g., no confirmation of a setuid/sudo misconfiguration, symlink race, or insecure IPC channel) to give administrators time to patch; no indicators of compromise, exploit code, or post-exploitation tradecraft beyond 'privilege escalation without user interaction' have been publicly disclosed as of this research.

A brief initial advisory reportedly preceded the full exploitation warning by a few days (described by BleepingComputer as having been published 'last weekend'), before Acronis expanded the advisory to confirm in-the-wild exploitation on September 15, 2026. Acronis has released fixed builds for both affected products: Backup plugin for cPanel & WHM 1.9.3 HF3, and Backup extension for Plesk 1.8.11.

This is not the first privilege-related issue in this plugin family, and the pattern is well-documented across three prior CVEs. CVE-2024-8767 (CVSS 9.9 via CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-250 Execution with Unnecessary Privileges), disclosed September 2024, affected sensitive data disclosure and manipulation due to unnecessary privileges assignment across Acronis Backup plugin for cPanel & WHM (before build 619), Backup extension for Plesk (before build 555), and Backup plugin for DirectAdmin (before build 147) -- the same three-panel product family, just not the same CVE. Separately, CVE-2024-34014 (CVSS 5.5, CWE-61 UNIX Symbolic Link (Symlink) Following, arbitrary file overwrite during recovery) and CVE-2024-34015 (CVSS 3.3, CWE-61, sensitive information disclosure during file browsing) were disclosed in November 2024 for the same cPanel & WHM plugin (and, for CVE-2024-34014, also the Plesk extension and DirectAdmin plugin), both stemming from improper symbolic-link handling exploitable by a local low-privileged attacker. The recurrence of privilege-boundary flaws in this product line is a relevant signal for defenders operating shared or reseller Linux hosting environments where backup agents commonly run with elevated (often root) privileges to back up all tenant accounts on a server -- a single low-privileged tenant compromising the backup agent's privilege boundary can have server-wide blast radius across every other hosted account. As of this research (2026-09-15), CVE-2026-87886 does not yet appear in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.09.14) or in the NVD/CVE.org record set (NVD API query returns zero results), consistent with its very recent (same-day) public disclosure; those catalogs typically lag initial vendor advisories by days to weeks.

## MITRE ATT&CK

- T1078.003 Local Accounts
- T1548 Abuse Elevation Control Mechanism
- T1082 System Information Discovery
- T1518 Software Discovery
- T1588.006 Vulnerabilities
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886** (`TL-2026-2523-SPL-001`)

Detects the exploitation moment for CVE-2026-87886: a process running under a non-root, tenant-level UID invokes the Acronis Backup plugin binary/agent for cPanel & WHM or the Backup extension for Plesk, and a root-UID (0) child process is spawned from that invocation without an intervening sudo/su/setuid authentication event. Acronis confirms exploitation requires no user interaction and only an existing low-privileged local account, so the signature is the UID transition itself, not a credential prompt.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1548, T1078.003
- **Data sources:** auditd, linux_secure, syslog_auth, cpanel_access_log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype=linux_secure OR sourcetype=auditd
| eval parent_uid=coalesce(auid, ppid_uid), child_uid=uid
| search (process_name="*acronis*" OR process_path="*acronis*" OR comm="*acronis*" OR process_path="*/opt/acronis/*" OR process_path="*/usr/local/cpanel/*acronis*" OR process_path="*plesk*acronis*")
| where child_uid=0 AND parent_uid!=0
| eval sudo_present=if(match(_raw, "(?i)sudo|pam_unix\(sudo|setuid attempt authorized"), "yes", "no")
| where sudo_present="no"
| stats earliest(_time) as first_seen, latest(_time) as last_seen, values(process_path) as process_path, values(host) as host, count by parent_uid, child_uid, user
| where count > 0
| sort - last_seen
```

### Microsoft KQL

```kql
let AcronisPattern = dynamic(["acronis", "/opt/acronis/", "acronis_backup", "AcronisBackupExtension"]);
Syslog
| where TimeGenerated > ago(24h)
| where Facility == "auth" or Facility == "authpriv" or ProcessName has_any (AcronisPattern) or SyslogMessage has_any (AcronisPattern)
| extend UidFrom = extract(@"uid=(\d+)", 1, SyslogMessage), UidTo = extract(@"euid=(\d+)", 1, SyslogMessage)
| where UidTo == "0" and UidFrom != "0" and UidFrom != ""
| where not(SyslogMessage has_any ("sudo:", "pam_unix(sudo"))
| project TimeGenerated, Computer, ProcessName, UidFrom, UidTo, SyslogMessage
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: Acronis Backup Plugin Root Privilege Escalation (CVE-2026-87886)
id: 7a9f2e1c-4b3d-4a2e-9c7f-1e8d6b5a3c02
status: experimental
description: Detects a non-root UID triggering an Acronis Backup plugin/extension process (cPanel & WHM or Plesk) that results in a root-UID (0) child process without a preceding sudo/su authentication event, consistent with active exploitation of CVE-2026-87886.
references:
    - https://security-advisory.acronis.com/advisories/SEC-10986
    - https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-15
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1078.003
    - attack.t1068
    - cve.2026.87886
    - cwe.269
logsource:
    category: process_creation
    product: linux
detection:
    selection_process:
        Image|contains:
            - 'acronis'
            - '/opt/acronis/'
            - 'AcronisBackupExtension'
    selection_uid_transition:
        ParentUser|startswith:
            - 'u'
            - 'cptmp'
        User: 'root'
    filter_authorized:
        CommandLine|contains:
            - 'sudo'
            - 'su -'
            - 'pam_unix(sudo'
    condition: selection_process and selection_uid_transition and not filter_authorized
falsepositives:
    - Legitimate root-scheduled Acronis backup cron jobs launched directly by root (parent already UID 0, so excluded by selection_uid_transition)
    - Administrator-initiated sudo-based Acronis plugin maintenance (excluded by filter_authorized)
level: high
```

**Known false positives:**

- Root-scheduled Acronis backup cron/systemd-timer jobs where the parent process is already UID 0
- Administrator sudo-based plugin maintenance sessions that legitimately transition to root

**Tuning notes:** Exclude known-good root-owned parent PPIDs for the vendor's own systemd unit/cron entry once your environment's baseline is captured; add the exact Acronis package binary path/name once confirmed in your build to reduce the wildcard-match surface.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886 (locked: unlock with TL Creds)
- Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 (locked: unlock with TL Creds)
- Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 (locked: unlock with TL Creds)
- Acronis Backup Plugin (cPanel/Plesk) Root-Privilege Escalation from Low-Privileged Session — CVE-2026-87886 (locked: unlock with TL Creds)
- Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 (locked: unlock with TL Creds)
- Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 (locked: unlock with TL Creds)
- Post-Exploitation Root-Context Discovery & Tenant File Access Following Acronis Plugin Escalation — CVE-2026-87886 (locked: unlock with TL Creds)
- Cross-Tenant Data Manipulation, Account Creation, and Service Disruption via Escalated Acronis Backup Context — CVE-2026-87886 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Acronis warns of actively exploited flaw in its cPanel backup plugin](https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/)
- [SEC-10986 - Acronis Advisory Database](https://security-advisory.acronis.com/advisories/SEC-10986)
- [Acronis cPanel Plugin Flaw Exploited in the Wild, Patch Now](https://securityonline.info/acronis-cpanel-plugin-vulnerability-exploited/)
- [NVD entry check for CVE-2026-87886 (queried 2026-09-15; not yet published in NVD)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-87886)
- [CISA Known Exploited Vulnerabilities Catalog (checked 2026-09-15, catalog v2026.09.14; CVE-2026-87886 not yet listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE-2024-8767 - Acronis Backup Linux Privilege Escalation (prior related flaw, same plugin family)](https://cert.kenet.or.ke/cve-2024-8767-acronis-backup-linux-privilege-escalation)
- [CVE-2024-8767 - NVD detail (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-250)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-8767)
- [CVE-2024-8767 detail - cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2024-8767)
- [CVE-2024-8767 detail - CVEdetails.com](https://www.cvedetails.com/cve/CVE-2024-8767/)
- [CVE-2024-34014 - Acronis Backup plugin symlink arbitrary file overwrite](https://www.strix.ai/cve/CVE-2024-34014)
- [CVE-2024-34015 - Acronis Backup plugin symlink information disclosure](https://www.strix.ai/cve/CVE-2024-34015)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2523