Acronis cPanel plugin root escalation exploited (CVE-2026-87886)

Actively exploited in the wild - CVE-2026-87886 is a high-severity local privilege escalation flaw in the Acronis Backup plugin for cPanel & WHM (before build 1.9.3.1021), the Acronis Backup extension for Plesk (before build 1.8.11.638), and the Acronis Backup plugin for DirectAdmin (before build 1.2.3.238) that lets any local user with low privileges gain root access through insecure file permissions. Vendor builds that correct the permissions are available; update immediately.

Overview

CVE-2026-87886 stems from insecure file permissions set by the Acronis Backup integration packages for three Linux hosting control panels. The installer and runtime leave files and directories writable or replaceable by unprivileged accounts. Because these paths are processed by root-level backup services, a local attacker can plant or alter a file that the service later executes or reads, inheriting root privileges without a password, race condition, or user interaction.

Successful exploitation gives an attacker full control of the underlying host. On shared hosting, that means one customer account can read or modify every other tenant’s data, tamper with backups, disable monitoring, and establish persistence that survives cPanel, Plesk, or DirectAdmin account resets. On dedicated servers, the same bug collapses the boundary between a hosting user and the operating system itself.

CISA has added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog, confirming real-world attacks. The low attack complexity and low privileges required (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N) make this an attractive foothold for commodity and targeted actors alike.

Impact on affected systems

• Any local shell account on the host, including compromised web applications that achieve command execution.
• Full root compromise of the server, followed by lateral movement into other hosted accounts.
• Integrity loss for backup jobs: attackers can replace or exfiltrate backup archives.
• Reputational and regulatory exposure for hosting providers running tenant workloads on the same system.

Remediation and mitigation

1. Acronis Backup plugin for cPanel & WHM: update to build 1.9.3.1021 or later.
2. Acronis Backup extension for Plesk: update to build 1.8.11.638 or later.
3. Acronis Backup plugin for DirectAdmin: update to build 1.2.3.238 or later.

If patching must be delayed, restrict shell access to trusted users, audit world-writable files under the plugin installation directories, and monitor for unexpected processes spawned by backup service accounts. After updating, review authentication logs and file integrity monitoring for evidence of prior exploitation, and rotate any credentials that were stored on affected hosts.

Security Insight

Control panel extensions inherit root because they must touch every tenant’s files, which makes their installers a high-value target: a single permission mistake converts a routine backup utility into a privilege escalator. This mirrors the pattern seen in the CrackArmor AppArmor findings, where trust placed in privileged Linux components was undermined by edge cases, and it aligns with a broader wave of cPanel-adjacent flaws covered in our weekly threat roundup. The Acronis case is a reminder that host-level backup software deserves the same patch discipline as the kernel itself. Teams tracking Linux root bugs should also review our coverage of CVE-2026-31431 and the CrackArmor AppArmor flaws.

Further Reading

• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• Nine CrackArmor Flaws in Linux AppArmor Enable Root
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs