Acronis bases its CVE-2026-87886 exploitation warning on one customer report
The 7.8-rated privilege escalation in Acronis' cPanel and WHM backup plugin needs a local account on the server to work. The hosting providers and MSPs that run those servers are the only party who can install the fix.
The Watch · Security desk
What happened
- The flaw comes from insecure file permissions and lets an authenticated user escalate privileges locally on a Linux server with no user interaction, at a CVSS score of 7.8.
- Affected are all Linux builds of the cPanel and WHM plugin earlier than 1.9.3.1021 and Plesk extension builds earlier than 1.8.11.638.
- A brief advisory appeared over the preceding weekend, and the version carrying the CVE identifier and the 7.8 score followed on Tuesday, September 15, 2026.
Why it matters
- Who's exposed exposure For a hosted site owner, whether the box running their site gets fixed depends entirely on their provider's change window.
- What's now possible capability Elevated privileges on that host sit alongside the software whose job is reading and restoring every hosted account's files, databases and mailboxes.
- What it limits constraint Indicators of compromise remain unpublished, so a provider cannot determine whether it was already hit. Installing the build is the only action available.
Next story · Security · Oct 5
Out-of-band Exchange Server patch closes a flaw that exposes colleagues' mail to signed-in attackersConfirmed3 publishers
Local privilege escalation is a second step. CVE-2026-87886 does nothing until an attacker already holds an authenticated account on the Linux server [3]. Those servers exist to run other people's websites, files, databases, mailboxes and hosting accounts through cPanel, WHM or Plesk [16][17]. The CVSS string also describes low attack complexity, meaning no conditions outside the attacker's control have to line up [18].
"Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments," Acronis said in its advisory [1]. In a statement to BleepingComputer, the company said that assessment is based on a single report from a "potentially affected" customer [7]. Acronis did not disclose when the activity occurred or what the attackers achieved past the escalation itself [8]. It is holding back technical detail so that administrators can patch first, BleepingComputer reported [9].
The fixed builds went out the week before the CVE-numbered advisory, according to Help Net Security [11]. On cPanel and WHM, anything earlier than build 1.9.3.1021 is affected and the fix is labelled 1.9.3 HF3; on Plesk the line is build 1.8.11.638, labelled 1.8.11 [5][6]. The label and the build string are different numbers, so confirming that a host is patched means reading the build [21]. Acronis says it has seen no exploitation of the Plesk extension [14].
Acronis is widely used by web hosting providers and managed service providers because they can offer its backup and security to their own clients under their own branding [15]. Those providers own this patch. The plugin runs on their server and is administered through WHM or Plesk, so the version to check and the hotfix to apply both sit with the provider, out of reach of the customer whose site sits on that box [20].
The impact described in the advisory is bounded to the host: a low-privileged attacker raising their permission level, then accessing or modifying sensitive data and disrupting the system, without user interaction [12]. On a hosting server, the software that does the reading is the backup plugin itself [17].
What to watch
- Whether Acronis publishes technical detail or indicators of compromise once it judges the patch window closed. That would give providers something to hunt on.
- A second in-the-wild report, or any exploitation against the Plesk extension. Acronis says it has seen no Plesk exploitation.
- Any disclosure of what the attackers did after escalating privileges on the affected cPanel and WHM host.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives65
- Confidence65
Perspective Coverage
4 publishers- Builder
- Builder 28%
- Operator
- Operator 61%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
"Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments"
- [2]
CVE-2026-87886 is a Linux privilege escalation vulnerability affecting Acronis' backup extensions for cPanel, WebHost Manager (WHM) and Plesk.
- [3]
CVE-2026-87886 stems from insecure file permissions and allows authenticated attackers to achieve local privilege escalation without any user interaction.
- [4]
The vulnerability is tracked as CVE-2026-87886 and carries a CVSS score of 7.8.
- [5]
All Linux versions of the Backup plugin for cPanel & WHM before build 1.9.3.1021 and the Backup extension for Plesk before build 1.8.11.638 are affected.
- [6]
Acronis advised administrators to immediately install Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3 and Acronis Backup extension for Plesk version 1.8.11.
- [7]
In a statement for BleepingComputer, Acronis noted that the exploitation assessment is based on a single report from a "potentially affected" customer.
- [8]
Acronis has identified no specific indicators of compromise and did not disclose when the activity occurred or what attackers achieved beyond the privilege-escalation impact described by the advisory.
- [9]
Further technical details on CVE-2026-87886 have not been published, as the company wants to give system administrators time to apply the available patches before sharing more information.
- [10]
The flaw was published in a brief advisory last weekend, and Acronis issued an update identifying it as CVE-2026-87886 and assigning a severity score of 7.8.
- [11]
Acronis pushed out security updates for the vulnerable backup plugins last week, and published the security advisory on Tuesday.
- [12]
A low-privileged attacker can exploit CVE-2026-87886 to increase their permission level on a vulnerable Linux server, potentially enabling them to access or modify sensitive data and disrupt the system without user interaction.
- [13]
Help Net Security published its report on CVE-2026-87886 on September 16, 2026.
- [14]
There are currently no signs of active exploitation on Plesk deployments.
- [15]
Acronis is popular among web hosting providers and managed service providers, since its platform lets them offer backup and security to their clients under their own branding.
- [16]
cPanel & WHM and Plesk are used by web hosting companies and server administrators to manage websites and servers through graphical interfaces.
- [17]
Acronis' backup add-ons connect the hosting control panel to the company's infrastructure, allowing administrators to back up and restore websites, files, databases, mailboxes and hosting accounts from within the cPanel and Plesk interfaces.
- [18]
The vulnerability's CVSS string indicates it can be exploited in low complexity attacks, meaning the attack does not require special conditions or circumstances beyond the attacker's control.
- [19]
The Acronis advisory that carried the CVE identifier and the 7.8 score was published on Tuesday, September 15, 2026.
- [20]
The party that has to install the update is the hosting provider or MSP operating the server, not the owner of a site hosted on it.
- [21]
The published fix labels and the affected build numbers are different strings (1.9.3 HF3 corresponds to build 1.9.3.1021; 1.8.11 corresponds to build 1.8.11.638), so verifying patch status requires reading the build number.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comAcronis warns of actively exploited flaw in its cPanel backup plugin
1 article · September 15, 2026
- helpnetsecurity.comAcronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)
1 article · September 16, 2026
- securityweek.comAcronis Patches Exploited Vulnerability in cPanel Backup Plugin
1 article · September 16, 2026
- thehackernews.comAcronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
2 articles · September 16, 2026
Topics and entities
Topics
- Vulnerability Exploitation
- Privilege Escalation
- Web hosting infrastructure
- Patch And Redeploy Latency
- Backup and Recovery Windows