{"id":"CVE-2026-87886","kind":"vulnerability","aliases":["CVE-2026-87886"],"related":[],"title":"acronis backup: Local privilege escalation due to insecure file permissions","description":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"The Acronis Backup plugin for cPanel and WHM and the Acronis Backup extension for Plesk ship with incorrect default file permissions that allow privilege escalation. A local user with low privileges can gain higher privileges on the server, and CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-09-16T00:00:00+00:00","products":[{"name":"acronis backup","fixed":["1.2.3"],"affected":"< 1.2.3","ecosystem":"vendor"},{"name":"acronis backup","fixed":["1.8.11"],"affected":"< 1.8.11","ecosystem":"vendor"},{"name":"acronis backup","fixed":["1.9.3"],"affected":"< 1.9.3","ecosystem":"vendor"},{"name":"acronis backup","fixed":[],"affected":"= 1.9.3","ecosystem":"vendor"},{"name":"Acronis Backup","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acronis-backup","cpanel","exploited","plesk","self-hosted","vendor","whm"],"not_affected_if":["no-acronis-plugin-installed"],"how_to_check":"Check whether the Acronis Backup cPanel/WHM plugin or Plesk extension is installed on the server; the sources do not name a file or command to confirm the permissions.","fix":"Apply the vendor mitigation or patch from Acronis; the sources do not give a version. If no mitigation is available, discontinue use of the product per CISA guidance.","status":"open","published_at":"2026-09-16T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:29+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:31:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from Acronis; the sources do not give a version. If no mitigation is available, discontinue use of the product per CISA guidance.","summary":"The Acronis Backup plugin for cPanel and WHM and the Acronis Backup extension for Plesk ship with incorrect default file permissions that allow privilege escalation. A local user with low privileges can gain higher privileges on the server, and CISA lists it as actively exploited.","category":"vendor","who_cares":["cpanel","whm","plesk","acronis-backup","self-hosted"],"confidence":0.6,"analyst_note":"Find the fixed version and the vendor advisory for CVE-2026-87886 from Acronis, plus the permission paths that are wrong, and confirm the attack requires local access.","how_to_check":"Check whether the Acronis Backup cPanel/WHM plugin or Plesk extension is installed on the server; the sources do not name a file or command to confirm the permissions.","needs_analyst":true,"not_affected_if":["no-acronis-plugin-installed"],"severity_if_unknown":"high"},"cost_usd":0.000411,"input_tokens":2194,"output_tokens":383,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':122C,148C,179C '-2026':12A,15A '-87886':13A,16A '26':121C,147C,178C 'accord':111C 'acroni':1A,28B,39B,48B,83C 'acronis':17A,19A,21A,23A,25A 'acronis-backup':27B 'action':107C 'activ':81B 'adher':175C 'allow':60B,101C 'appli':108C 'applic':145C 'asset':169C 'backup':2A,18A,20A,22A,24A,26A,29B,40B,49B,84C 'base':126C 'bod':120C,146C,177C 'cisa':77B,105C,118C,135C 'cloud':151C 'complianc':116C 'contain':93C 'could':100C 'cpanel':30B,43B,87C 'cve':11A,14A 'default':56B,96C 'discontinu':154C 'due':6A 'ensur':115C,174C 'escal':5A,62B,104C 'evalu':167C 'exploit':31B,82B 'exposur':172C 'extens':50B,90C 'file':9A,57B 'follow':144C 'forens':137C 'gain':70B 'guidanc':133C,149C 'guidelin':181C 'higher':71B 'host':35B 'incorrect':55B,95C 'insecur':8A 'instruct':114C 'internet':171C 'list':78B 'local':3A,64B 'low':67B 'mitig':109C,160C 'note':132C,143C 'patch':180C 'permiss':10A,58B,97C 'plesk':32B,52B,92C 'plugin':41B,85C 'priorit':123C 'privileg':4A,61B,68B,72B,103C 'product':158C 'requir':106C,139C 'respons':165C 'risk':128C 'secur':124C 'see':129C,140C 'self':34B 'self-host':33B 'server':75B 'servic':152C 'ship':53B 'stakehold':163C 'triag':138C 'unavail':162C 'updat':125C 'url':130C,141C 'use':155C 'user':65B 'vendor':36B,113C 'vulner':98C 'whm':37B,45B,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T00:00:00+00:00","kev":{"dateAdded":"2026-09-16","dueDate":"2026-09-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@acronis.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-87886","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886","severity":null,"published_at":"2026-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-87886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87886","severity":null,"published_at":"2026-09-17T23:18:53+00:00","modified_at":"2026-09-18T19:29:35+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}