Reported by 11 outlets

Timeline

1. update from bleepingcomputer.com

   Acronis warns of actively exploited flaw in its cPanel backup plugin

   bleepingcomputer.com · 28d ago · September 15th, 2026

   Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. cPanel & WHM and Plesk are used by web hosting companies and server administrators to manage websites and servers through graphical interfaces. Acronis’ backup add-ons connect the hosting control panel to the company's infrastructure, allowing administrators to back up and restore websites, files, databases, mailboxes, and hosting accounts from within the cPanel and Plesk interfaces. The flaw was published in a brief advisory last weekend, but the technology company issued an update today, identifying it as CVE-2026-87886 and assigning it a severity score of 7.8. A low-privileged attacker can exploit CVE-2026-87886 to increase their permission level on a vulnerable Linux server, potentially enabling them to access or modify sensitive data and disrupt the system without user interaction. Further technical details on CVE-2026-87886 have not been published, as the company wants to give system administrators time to apply the available patches before sharing more information. Acronis says it has detected exploitation of the vulnerability in the wild, "in limited, targeted attacks." “Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments,” the advisory warns . In a statement for BleepingComputer, Acronis n

2. mentioned by www.bleepingcomputer.com

   🤖 CVE-2026-87886: actively exploited Linux local privilege escalation in the Acronis Backup plugin for cPanel, WHM and Plesk. High severity,

   www.bleepingcomputer.com · 28d ago · September 15th, 2026

3. update from cyberpress.org

   Acronis Backup Plugin Vulnerability in cPanel and Plesk Exploited in the Wild

   cyberpress.org · 27d ago · September 16th, 2026

   Tracked as CVE-2026-87886, the security flaw affects Linux-based Acronis backup components used in shared hosting and managed server environments. Acronis assigned the vulnerability a CVSS severity score of 7.8 out of 10, classifying it as high severity. The issue is categorized as CWE-276, or incorrect default permissions. This weakness can occur when sensitive files, directories, or system resources receive broader permissions than intended. Acronis Backup Plugin Vulnerability In affected Acronis deployments, insecure file permissions could enable a local low-privileged user to access resources or execute actions beyond their authorized level. According to the CVSS vector, exploitation requires an attacker to already have local access to the affected Linux server and hold low-level privileges. The flaw does not require user interaction, making it particularly concerning after an initial compromise. A threat actor could potentially gain initial access through a compromised hosting account, weak credentials, a vulnerable web application, a web shell, or another attack path. They could then abuse the vulnerable Acronis component to obtain elevated privileges on the underlying server. Successful exploitation may affect the confidentiality, integrity, a

4. update from securityweek.com

   Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

   securityweek.com · 27d ago · September 16th, 2026

   Related: Oracle Patches 800+ Vulnerabilities in September 2026 Security Update Related: ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks Related: Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation Related: Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months

5. mentioned by gbhackers.com

   Acronis Backup Plugin Vulnerability Exploited in the Wild to Gain Elevated Linux Privileges

   gbhackers.com · 27d ago · September 16th, 2026

6. mentioned by deafnews.it

   Acronis patches CVE-2026-87886, a local privilege escalation flaw actively exploited in cPanel & WHM deployments. CVSS 7.8. https:// deafnew

   deafnews.it · 27d ago · September 16th, 2026

7. update from bugstoday.com

   https:// bugstoday.com/acronis-backup-p lugin-is-being-exploited-to-escape-into-root/ # Cybersecurity # InfoSec # CVE # Vulnerability # Secu

   bugstoday.com · 27d ago · September 16th, 2026

   https:// bugstoday.com/acronis-backup-p lugin-is-being-exploited-to-escape-into-root/ # Cybersecurity # InfoSec # CVE # Vulnerability # Secu

   via Mastodon https://bugstoday.com/acronis-backup-plugin-is-being-exploited-to-escape-into-root/

8. update from go.rodtrent.com

   Security Check-in Quick Hits: Pixel Modem Zero-Day, WSO2 JWT Bypass, and Acronis cPanel Privilege Escalation Under Active Attack # Security

   go.rodtrent.com · 27d ago · September 16th, 2026

   Security Check-in Quick Hits: Pixel Modem Zero-Day, WSO2 JWT Bypass, and Acronis cPanel Privilege Escalation Under Active Attack # Security

   via Mastodon https://go.rodtrent.com/go/8nkkesa

9. update from beyondmachines.net

   Acronis Patches Actively Exploited Privilege Escalation Flaw in Hosting Plugins Acronis patched a high-severity privilege escalation vulnera

   beyondmachines.net · 26d ago · September 17th, 2026

   Acronis Patches Actively Exploited Privilege Escalation Flaw in Hosting Plugins Acronis patched a high-severity privilege escalation vulnera

   via Mastodon https://beyondmachines.net/event_details/acronis-patches-actively-exploited-privilege-escalation-flaw-in-hosting-plugins-a-s-1-m-a/gD2P6Ple2L

10. update from socprime.com

    CVE-2026-87886: Acronis Backup Plugin Privilege Escalation Flaw Exploited in Targeted Attacks

    socprime.com · 26d ago · September 17th, 2026

    The vulnerability is particularly significant for web hosting providers and managed service providers because these plugins connect hosting control panels to Acronis backup infrastructure and support backup and recovery of websites, databases, mailboxes, and entire servers. On September 16, 2026, CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog, confirming exploitation and requiring affected U.S. federal civilian agencies to remediate the issue by September 19, 2026 .

11. mentioned by www.yazoul.net

    🟠 New security advisory: CVE-2026-87886 affects multiple systems. • Impact: Significant security breach potential • Risk: Unauthorized acces

    www.yazoul.net · 26d ago · September 18th, 2026

12. mentioned by www.yazoul.net

    🟠 New security advisory: CVE-2026-87886 affects multiple systems. • Impact: Significant security breach potential • Risk: Unauthorized acces

    www.yazoul.net · 26d ago · September 18th, 2026