CVE-2026-87886: Acronis Backup Plugin for cPanel & Plesk — Incorrect Default Permissions Enable Privilege Escalation

Background

Acronis Backup integrates directly into two of the most widely used web hosting control panels: as a plugin for cPanel & WHM and as an extension for Plesk. Hosting providers and resellers use it to offer backup and restore capabilities to their customers’ hosted accounts and sites. Because cPanel/WHM and Plesk environments are inherently multi-tenant — many customer accounts sharing the same underlying server — any vulnerability that breaks the isolation between tenants is especially consequential.

CVE-2026-87886 is an incorrect default permissions issue in this plugin/extension that could allow privilege escalation.

Technical Mechanism

This vulnerability is classified as CWE-276 (Incorrect Default Permissions).

The CISA KEV description is brief and does not name the specific file, directory, or resource involved, so the precise mechanics should be confirmed against Acronis’s own advisory (SEC-10986). That said, CWE-276 issues in hosting-panel plugins follow a recognizable pattern: the plugin or extension installs files, configuration, sockets, or scripts with permissions that are broader than intended — for example, world-readable where only the backup service’s own privileged account should have read access, or world-writable where only that account should be able to write.

On a shared hosting system, this matters because many mutually untrusted customer accounts run on the same host, often with shell or cron access. If a backup-related file that is consumed or executed by a privileged process (commonly running as root under WHM, or with elevated Plesk service permissions) is left writable by unprivileged local accounts, any hosting customer could modify that file’s content. When the privileged backup service subsequently reads or executes it, the customer’s planted content runs with the service’s elevated privileges — a classic “attacker writes, victim’s privileged process executes” escalation pattern. Alternatively, if a file containing credentials or tokens is left world-readable, a local account could read secrets it should never have access to and reuse them to escalate privileges or move laterally.

Because the exact affected file/path is not specified in the available KEV data, organizations should not assume they understand the full mechanism without consulting Acronis’s SEC-10986 advisory directly.

Real-World Exploitation Evidence

CVE-2026-87886 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, added on September 16, 2026, confirming active exploitation in the wild.

The knownRansomwareCampaignUse field is recorded as “Unknown” — CISA has not confirmed ransomware actors have used this vulnerability. This reflects the absence of public confirmation rather than a confirmed absence of such use.

No specific threat actor, intrusion set, or named campaign has been publicly attributed to exploitation of this CVE based on the data available for this article.

Impact Assessment

On a single-tenant system, an incorrect-permissions privilege escalation bug is serious but contained to that system. On the shared, multi-tenant hosting environments where cPanel/WHM and Plesk are typically deployed — which is precisely where Acronis Backup’s plugin and extension are designed to run — the impact is amplified substantially:

• Integrity/confidentiality impact: A local hosting customer who escalates to root (WHM) or an equivalent elevated service account on Plesk gains access to every other customer’s files, databases, and backups on that server — not just their own account.
• Availability impact: With root or elevated privileges, an attacker could disrupt service for the entire server, not just their own hosting account.
• Business impact for hosting providers: This is a reputationally severe bug class for hosting providers specifically, since the entire value proposition of shared hosting rests on tenant isolation. A single malicious or compromised customer account becoming a path to full-server compromise undermines that isolation guarantee directly.

Affected Versions

The KEV data provided does not include an explicit version matrix. Acronis’s own advisory is the authoritative source:

Remediation Steps

1. Update the Acronis Backup plugin (cPanel & WHM) and extension (Plesk) to the version specified as fixed in advisory SEC-10986.

2. Audit default file and directory permissions created by the plugin/extension installer on any system where it has been installed, even after patching, to confirm no residual overly permissive artifacts remain from a prior vulnerable version.

   # Example: look for unexpectedly world-writable or world-readable files
   # under common plugin install paths (adjust paths per your panel/OS)
   find /usr/local/cpanel/base/frontend -perm -o+w -ls 2>/dev/null
   find /opt/acronis -perm -o+r -ls 2>/dev/null

3. Restrict shell and cron access for hosting customer accounts where not strictly required, as a general hardening measure that reduces the pool of local accounts able to exploit this class of bug.

4. Rotate any credentials stored in configuration files that may have been exposed by the incorrect permissions, out of caution.

5. Follow BOD 26-04 guidance on prioritizing security updates based on risk for any hosting infrastructure in scope of that directive.

Detection Guidance

• Permission change monitoring: alert on changes to file permissions within the Acronis plugin/extension’s installation paths, particularly any made by accounts other than the service’s own privileged account.
• Unexpected modifications: file integrity monitoring on backup-plugin configuration and executable files can reveal tampering by a local, lower-privileged account.
• Privilege escalation indicators: review for unexpected process executions by the backup service’s privileged account immediately following modification of files it consumes, which would indicate the “write-then-execute” exploitation pattern typical of this CWE class.

Exact IOC or log-signature guidance was not available in the source material for this article; hosting providers should watch for updates from Acronis’s advisory for more specific detection content.

Timeline

References

• Acronis Security Advisory SEC-10986
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-87886