CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Acronis Backup plugin for cPanel & WHM/Plesk local privilege escalation via insecure default permissions (CVSS 7.8), CISA KEV-listed 2026-09-16, exploitation basis is a single customer report

cve · CVE-2026-87886

Coverage
1
first 2026-09-18 → last 2026-09-30
Latest activity
2026-09-18
Acronis says its cPanel backup plugin's privilege-escalation flaw was exploited, citing one customer's report
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-87886, newest first. Check the date before acting on an older one.

  • Update the Acronis Backup plugin/extension on every cPanel & WHM (<1.9.3.1021) or Plesk (<1.8.11.638) server to the fixed build now, regardless of the single-customer-report basis behind Acronis's exploitation claim.
    2026-09-18CVE-2026-87886

Defender insights

What each entry about CVE-2026-87886 tells a defender to do, newest first.

Story timeline

  1. 2026-09-18CVE-2026-87886, Acronis Backup plugin for cPanel/WHM and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)
    trending-vulnerabilitiesAcronis says its cPanel backup plugin's privilege-escalation flaw was exploited, citing one customer's report

Hunting pivots

Affected products
Acronis Backup extension for Plesk (Linux)Acronis Backup plugin for cPanel & WHM (Linux)
Tags
cisa-kevpatch-availablepriv-escvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-18/cve-2026-87886-acronis-backup-plugin-lpe-cpanel-kev · ATT&CK page ↗

Entries about Acronis Backup plugin for cPanel & WHM/Plesk local privilege escalation via insecure default permissions (CVSS 7.8), CISA KEV-listed 2026-09-16, exploitation basis is a single customer report (1)

2026-09-18 · view entry permalink →

NOTABLECVE-2026-87886exploitedupdatedNATOB2

CVE-2026-87886, Acronis Backup plugin for cPanel/WHM and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)

CVE-2026-87886 is a local privilege-escalation flaw from insecure file permissions in the Acronis Backup plugin for cPanel & WHM and extension for Plesk, both on Linux (Help Net Security, 2026-09-16), which Acronis scores at CVSS 7.8 (BleepingComputer, 2026-09-15). CISA's KEV record classes it as incorrect default permissions (CWE-276) (CISA KEV catalog, 2026-09-16). A low-privileged attacker on an affected server can raise their permission level without user interaction (BleepingComputer, 2026-09-15); no remote or unauthenticated path is described. Acronis's advisory states that "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments", and Acronis told BleepingComputer that the assessment rests on a single report from a "potentially affected" customer and has identified no indicators of compromise (BleepingComputer, 2026-09-15). Help Net Security reports no signs of active exploitation on Plesk deployments (Help Net Security, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA KEV catalog, 2026-09-16). Builds of the cPanel & WHM plugin earlier than 1.9.3.1021 are fixed in 1.9.3 HF3, and builds of the Plesk extension earlier than 1.8.11.638 are fixed in 1.8.11 (BleepingComputer, 2026-09-15).

Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments

Acronis (via BleepingComputer)

the assessment is based on a single report from a "potentially affected" customer

BleepingComputer 2026-09-15
Correctionrun 2026-09-30T0639Z-auditprioritybodyheadlinesummaryevidence

The earlier headline and summary said CISA listed the flaw on the strength of a single customer's report, and the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing. The single-customer basis belongs to Acronis's own exploitation assessment (BleepingComputer, 2026-09-15). The CWE-276 class comes from CISA's KEV record (CISA KEV catalog, 2026-09-16), not from Help Net Security.

vulnerability18 Sep 04:52Zmulti-sourceOpen finding →
Sources: Help Net Security · BleepingComputer · CISA Known Exploited Vulnerabilities Catalog (JSON feed)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • cisa.gov1 (33%)
  • helpnetsecurity.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)