CVE-2026-87886 · Low · CISA KEV

Acronis Backup Plugin Privilege Escalation (CVE-2026-87886) Exploited In Wild

Threat Engine Auto-Feed · data current as of 2026-09-17

CVE-2026-87886, an incorrect default permissions vulnerability in Acronis Backup plugins for cPanel/WHM and Plesk, allows for privilege escalation. This vulnerability has been added to CISA KEV, indicating active exploitation. Organizations using these backup solutions should prioritize mitigation.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from incorrect default permissions, meaning that certain files or directories within the Acronis Backup plugin/extension are configured with overly permissive access rights. This allows a lower-privileged user or process to gain elevated privileges, potentially leading to full system control.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Acronis Backup with cPanel & WHM or Plesk, particularly those in Financial Services and Technology sectors due to documented adversary targeting.
  • Environments where backup solutions are critical infrastructure and have broad access to other systems.

Misconfigurations that escalate it

  • Failure to review and harden default permissions for installed plugins and extensions.
  • Running backup solutions with excessive privileges beyond their operational needs.

High-impact scenarios

  • An attacker gaining elevated privileges on a server, potentially leading to full system compromise.
  • Compromise of backup infrastructure, enabling data manipulation, exfiltration, or destruction.
  • Lateral movement within the network from a compromised backup server to other critical assets.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unusual process activity or privilege changes originating from Acronis Backup components.
  • Audit file and directory permissions for Acronis Backup installations, specifically for cPanel & WHM plugins and Plesk extensions, against vendor-recommended secure configurations.
  • Review logs for any unauthorized access attempts or modifications related to backup configurations.

Contain

  • Isolate affected systems running Acronis Backup with cPanel & WHM or Plesk from the network if compromise is suspected.
  • Revoke any unnecessary privileges granted to the Acronis Backup service accounts or associated users.
  • Implement strict network segmentation to limit the blast radius of a compromised backup server.

Patch

  • Apply the latest security updates and patches from Acronis for Backup, specifically addressing CVE-2026-87886.
  • Follow vendor guidance to correct any incorrect default permissions post-patching or during installation.

Frontier verdict — Low

This is a high-priority vulnerability due to its presence in the CISA KEV, indicating active exploitation, and its potential for privilege escalation in critical backup infrastructure.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.