CVE-2026-87886, Acronis Backup plugins for cPanel/WHM and DirectAdmin and extension for Plesk: local privilege escalation via insecure default permissions, CISA KEV-listed (CVSS 7.8)
Acronis says its cPanel backup plugin's privilege-escalation flaw was exploited, citing one customer's report
Defender actions
- Update the Acronis Backup plugin/extension on every cPanel & WHM (<1.9.3.1021), Plesk (<1.8.11.638) or DirectAdmin (<1.2.3.238) server to the fixed build now, regardless of the single-customer-report basis behind Acronis's exploitation claim.
Analysis
CVE-2026-87886 is a local privilege-escalation flaw from insecure file permissions in the Acronis Backup plugins for cPanel & WHM and for DirectAdmin and the extension for Plesk, all on Linux (Help Net Security, 2026-09-16) (Acronis, 2026-09-17), which Acronis scores at CVSS 7.8 (BleepingComputer, 2026-09-15). CISA's KEV record classes it as incorrect default permissions (CWE-276) (CISA KEV catalog, 2026-09-16). A low-privileged attacker on an affected server can raise their permission level without user interaction (BleepingComputer, 2026-09-15); no remote or unauthenticated path is described. Acronis's advisory states that "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments", and Acronis told BleepingComputer that the assessment rests on a single report from a "potentially affected" customer and has identified no indicators of compromise (BleepingComputer, 2026-09-15). Help Net Security reports no signs of active exploitation on Plesk deployments (Help Net Security, 2026-09-16). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-16; the listing's description names only the cPanel & WHM plugin and the Plesk extension (CISA KEV catalog, 2026-09-16). Builds of the cPanel & WHM plugin earlier than 1.9.3.1021 are fixed in 1.9.3 HF3, and builds of the Plesk extension earlier than 1.8.11.638 are fixed in 1.8.11 (BleepingComputer, 2026-09-15); the DirectAdmin plugin is fixed in build 1.2.3.238 (Acronis, 2026-09-17).
Contradiction: Acronis's advisory record is stamped 2026-09-17, while Help Net Security reports the advisory as published on Tuesday, 2026-09-15 (Help Net Security, 2026-09-16); the earlier date is the one the reporting quotes.
Cited evidence
Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments
the assessment is based on a single report from a "potentially affected" customer
Updates3
The earlier headline and summary said CISA listed the flaw on the strength of a single customer's report, and the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing. The single-customer basis belongs to Acronis's own exploitation assessment (BleepingComputer, 2026-09-15). The CWE-276 class comes from CISA's KEV record (CISA KEV catalog, 2026-09-16), not from Help Net Security.
Acronis's advisory SEC-10986 lists three affected products, not two: the Acronis Backup plugin for cPanel & WHM (fixed in build 1.9.3.1021), the Acronis Backup extension for Plesk (fixed in build 1.8.11.638) and the Acronis Backup plugin for DirectAdmin on Linux (fixed in build 1.2.3.238) (Acronis, 2026-09-17). DirectAdmin servers running the plugin need the same update.
CISA's KEV listing describes the flaw only in the Acronis Backup plugin for cPanel & WHM and the extension for Plesk (CISA KEV catalog, 2026-09-16). The plugin for DirectAdmin is named as affected only in Acronis's advisory, which limits its exploitation statement to cPanel & WHM deployments (Acronis, 2026-09-17); a DirectAdmin server needs the fixed build whether or not an inventory matched against the KEV description flags it.
Sources4
Revision history
- Published 2026-09-18T0410Z-intel
- Correction 2026-09-30T0639Z-audit
The headline and summary said CISA listed the flaw on the strength of a single customer's report, while the takeaway said the listing reflected CISA's own independent judgment. No cited source states the basis of CISA's listing, and the single-customer basis belongs to Acronis's own exploitation assessment. The CWE-276 class is CISA's. A US federal remediation deadline is dropped from the main text. The priority moves from high to notable.
Changed: priority body headline summary evidence
- Correction 2026-10-11T1307Z-audit
Acronis's advisory SEC-10986 lists a third affected product, the Acronis Backup plugin for DirectAdmin on Linux, fixed in build 1.2.3.238, which the entry had left out. The advisory is readable as a structured record and is now the primary source.
Changed: summary affected_products cves sources sourcing_note actions body title
- Improvement 2026-10-20T0835Z-audit
CISA's KEV listing describes only the cPanel & WHM plugin and the Plesk extension; the DirectAdmin plugin is named as affected only in Acronis's advisory, whose exploitation statement covers cPanel & WHM deployments alone.
Changed: body title
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.