CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Acronis Backup plugin for DirectAdmin (Linux)

product · product:acronis-backup-plugin-for-directadmin-linux

Coverage
1
first 2026-09-18 → last 2026-10-11
Latest activity
2026-09-18
Acronis says its cPanel backup plugin's privilege-escalation flaw was exploited, citing one customer's report
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about Acronis Backup plugin for DirectAdmin (Linux), newest first. Check the date before acting on an older one.

  • Update the Acronis Backup plugin/extension on every cPanel & WHM (<1.9.3.1021), Plesk (<1.8.11.638) or DirectAdmin (<1.2.3.238) server to the fixed build now, regardless of the single-customer-report basis behind Acronis's exploitation claim.
    2026-09-18CVE-2026-87886

Defender insights

What each entry about Acronis Backup plugin for DirectAdmin (Linux) tells a defender to do, newest first.

Story timeline

  1. 2026-09-18CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)
    trending-vulnerabilitiesAcronis says its cPanel backup plugin's privilege-escalation flaw was exploited, citing one customer's report

Hunting pivots

CVEs (exploited first)
CVE-2026-87886
Releases covered
Acronis Backup plugin for DirectAdmin (Linux)
Tags
cisa-kevpatch-availablepriv-escvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-18/cve-2026-87886-acronis-backup-plugin-lpe-cpanel-kev · ATT&CK page ↗

Entries about Acronis Backup plugin for DirectAdmin (Linux) (1)

2026-09-18 · view entry permalink →

NOTABLECVE-2026-87886exploitedupdatedNATOB2

CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)

CVE-2026-87886 is a local privilege-escalation flaw from insecure file permissions in the Acronis Backup plugins for cPanel & WHM and for DirectAdmin and the extension for Plesk, all on Linux (Help Net Security, 2026-09-16) (Acronis, 2026-09-17), which Acronis scores at CVSS 7.8 (BleepingComputer, 2026-09-15). CISA's KEV record classes it as incorrect default permissions (CWE-276) (CISA KEV catalog, 2026-09-16). A low-privileged attacker on an affected server can raise their permission level without user interaction (BleepingComputer, 2026-09-15); no remote or unauthenticated path is described. Acronis's advisory states that "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments", and Acronis told BleepingComputer that the assessment rests on a single report from a "potentially affected" customer and has identified no indicators of compromise (BleepingComputer, 2026-09-15). Help Net Security reports no signs of active exploitation on Plesk deployments (Help Net Security, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-16 (CISA KEV catalog, 2026-09-16). Builds of the cPanel & WHM plugin earlier than 1.9.3.1021 are fixed in 1.9.3 HF3, and builds of the Plesk extension earlier than 1.8.11.638 are fixed in 1.8.11 (BleepingComputer, 2026-09-15); the DirectAdmin plugin is fixed in build 1.2.3.238 (Acronis, 2026-09-17).

Contradiction: Acronis's advisory record is stamped 2026-09-17, while Help Net Security reports the advisory as published on Tuesday, 2026-09-15 (Help Net Security, 2026-09-16); the earlier date is the one the reporting quotes.

Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments

Acronis (via BleepingComputer)

the assessment is based on a single report from a "potentially affected" customer

BleepingComputer 2026-09-15
Correctionrun 2026-09-30T0639Z-auditprioritybodyheadlinesummaryevidence

The earlier headline and summary said CISA listed the flaw on the strength of a single customer's report, and the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing. The single-customer basis belongs to Acronis's own exploitation assessment (BleepingComputer, 2026-09-15). The CWE-276 class comes from CISA's KEV record (CISA KEV catalog, 2026-09-16), not from Help Net Security.

Correctionrun 2026-10-11T1307Z-auditsummaryaffected_productscvessourcessourcing_noteactionsbodytitle

Acronis's advisory SEC-10986 lists three affected products, not two: the Acronis Backup plugin for cPanel & WHM (fixed in build 1.9.3.1021), the Acronis Backup extension for Plesk (fixed in build 1.8.11.638) and the Acronis Backup plugin for DirectAdmin on Linux (fixed in build 1.2.3.238) (Acronis, 2026-09-17). DirectAdmin servers running the plugin need the same update.

vulnerability18 Sep 04:52Zmulti-sourceOpen finding →
Sources: Acronis Security Advisory SEC-10986 · Help Net Security · BleepingComputer · CISA Known Exploited Vulnerabilities Catalog (JSON feed)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (25%)
  • cisa.gov1 (25%)
  • helpnetsecurity.com1 (25%)
  • security-advisory.acronis.com1 (25%)
All cited sources (4)