Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

Summary: Acronis warned that a high-severity flaw in its Backup plugin for cPanel and Web Host Manager deployments, tracked as CVE-2026-87886 with a CVSS score of 7.8, has been exploited in limited, targeted attacks. The vulnerability is a local privilege escalation caused by insecure file permissions that lets an attacker with low privileges escalate permissions on a susceptible Linux system, and Acronis said the fix is in version 1.9.3 HF3.
Key Takeaway: CISA added CVE-2026-87886 to its KEV catalog on September 16, 2026, giving federal civilian agencies until September 19, 2026 to patch - a three-day window that signals how urgently the flaw is being worked. Acronis has not disclosed who is behind the attacks or what they are after, so the exposure on your cPanel and WHM hosts is not yet fully characterized.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-87886
Related: CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability Known Exploited Vulnerabilities · Sep 16, 2026
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026