CVE-2026-87886

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-87886

Acronis · Backup · Added 2026-09-16

3-Day Required KEV Active Exploitation

Details

VulnerabilityAcronis Backup Incorrect Default Permissions Vulnerability

VendorAcronis

ProductBackup

Date added2026-09-16

Due date2026-09-19

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-276

Descriptions

KEV: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-16 19:53 UTC

Wall time0.3s

Searches1

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-87886
https://security-advisory.acronis.com/advisories/SEC-10986
https://cveawg.mitre.org/api/cve/CVE-2026-87886
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886
https://api.github.com/search/repositories?q=CVE-2026-87886

Hunting hypothesis agent

Look for unexpected writes, ownership changes, or file replacements under the Acronis cPanel & WHM plugin and Plesk extension directories — auditd or file-integrity telemetry catching local privesc staging on shared hosting servers.

Research details

ComponentInsecure default file permissions on the cPanel & WHM plugin and Plesk extension files (CWE-276)

PreconditionsLocal access to a Linux server running Acronis Backup plugin for cPanel & WHM before 1.9.3.1021 or the Acronis Backup extension for Plesk before 1.8.11.638. Insecure default permissions on the plugin's files let any local low-privileged user (CVSS PR:L, no user interaction) escalate to root; no network reachability required. Acronis confirms exploitation in the wild in limited, targeted attacks against cPanel & WHM deployments. agent

DeliveryLocal privilege escalation: a low-privileged local user exploits insecure default permissions on the plugin's files (modifying or replacing them) to gain elevated privileges.

Public PoCno

Advisoryhttps://security-advisory.acronis.com/advisories/SEC-10986

Exploit notesVendor CVSS 3.0: 7.8 (AV:L/AC:L/PR:L/UI:N) — local, low-privileged attacker, no user interaction. Acronis (SEC-10986) confirms exploitation detected in the wild in limited, targeted attacks against cPanel & WHM deployments. No public exploit or PoC identified; the KEV listing (2026-09-16) precedes any public technical detail.

SummaryCVE-2026-87886 is an incorrect default permissions vulnerability (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk on Linux. Insecure permissions on the integration files allow a local user to escalate privileges to root. Acronis advisory SEC-10986 (CVSS 7.8, fixed in plugin 1.9.3.1021 and extension 1.8.11.638) reports exploitation in the wild in limited, targeted attacks against cPanel & WHM deployments; no public PoC is known.

Tia coverage

First reported2026-09-15

First exploit report2026-09-15

Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

acronis-s-cpanel-backup-plugin-is-being-actively-exploited-for-s

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.