---
id: "CVE-2026-87886"
kind: "vulnerability"
aliases: ["CVE-2026-87886"]
title: "acronis backup: Local privilege escalation due to insecure file permissions"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "acronis backup", "fixed": ["1.2.3"], "affected": "< 1.2.3", "ecosystem": "vendor"}, {"name": "acronis backup", "fixed": ["1.8.11"], "affected": "< 1.8.11", "ecosystem": "vendor"}, {"name": "acronis backup", "fixed": ["1.9.3"], "affected": "< 1.9.3", "ecosystem": "vendor"}, {"name": "acronis backup", "fixed": [], "affected": "= 1.9.3", "ecosystem": "vendor"}, {"name": "Acronis Backup", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acronis-backup", "cpanel", "exploited", "plesk", "self-hosted", "vendor", "whm"]
not_affected_if: ["no-acronis-plugin-installed"]
published_at: "2026-09-16T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87886", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# acronis backup: Local privilege escalation due to insecure file permissions

The Acronis Backup plugin for cPanel and WHM and the Acronis Backup extension for Plesk ship with incorrect default file permissions that allow privilege escalation. A local user with low privileges can gain higher privileges on the server, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:acronis backup affected < 1.2.3 fixed 1.2.3
- vendor:acronis backup affected < 1.8.11 fixed 1.8.11
- vendor:acronis backup affected < 1.9.3 fixed 1.9.3
- vendor:acronis backup affected = 1.9.3 fixed ?
- vendor:Acronis Backup affected ? fixed ?

## How to check

Check whether the Acronis Backup cPanel/WHM plugin or Plesk extension is installed on the server; the sources do not name a file or command to confirm the permissions.

## Fix

Apply the vendor mitigation or patch from Acronis; the sources do not give a version. If no mitigation is available, discontinue use of the product per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87886

## From the sources

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_