Acronis has issued a warning about a high-severity local privilege escalation vulnerability, identified as CVE-2026-87886, affecting its backup plugins for cPanel & WHM and Plesk. The company states that this flaw is being actively exploited in targeted attacks.
The vulnerability, which carries a CVSS score of 7.8, allows a low-privileged attacker on a Linux server to elevate their permissions without user interaction. This could potentially enable unauthorized access to sensitive data, modification of system configurations, or disruption of services.
Acronis backup plugins integrate with cPanel & WHM and Plesk, which are widely used control panels for managing web hosting accounts and servers. These plugins allow administrators to perform backup and restoration operations for websites, files, databases, and mailboxes directly through the control panel interfaces.
According to Acronis, the observed exploitation of CVE-2026-87886 has been limited to specific, targeted attacks against deployments of the Acronis Backup plugin for cPanel & WHM. The company's assessment of active exploitation is based on a single report from a customer who may have been affected.
The company has not released specific indicators of compromise, nor has it disclosed the timeline of the attacks or the full extent of what attackers achieved beyond the privilege escalation. Further technical details about CVE-2026-87886 are being withheld to allow system administrators sufficient time to apply patches before more information is publicly available.
The vulnerability impacts Acronis Backup plugin for cPanel & WHM builds earlier than 1.9.3.1021. The fix is available in version 1.9.3 HF3. For the Acronis Backup extension for Plesk, builds earlier than 1.8.11.638 are affected, with the patch included in version 1.8.11.
Acronis strongly recommends that all users of the affected backup integrations for cPanel & WHM and Plesk apply the available updates immediately to mitigate the risk of exploitation.
