Acronis cPanel Backup Flaw CVE-2026-87886 Exploited in Wild

Acronis has issued an urgent security advisory (SEC-10986) warning of active, in-the-wild exploitation targeting a high-severity local privilege escalation vulnerability in its backup plugins for Linux web hosting environments. Tracked as CVE-2026-87886, the flaw carries a CVSS v3.0 base score of 7.8 (High) and affects enterprise deployments across cPanel & WebHost Manager (WHM) as well as Plesk control panels.

Both cPanel & WHM and Plesk serve as core management backbones for commercial web hosts, cloud service providers, and shared hosting platforms worldwide. Acronis backup plugins facilitate automated disaster recovery by bridging the hosting control interface directly to Acronis cloud storage infrastructure, allowing administrators and tenants to schedule, backup, and restore databases, mailboxes, and file systems. Acronis confirmed that adversaries have actively weaponized CVE-2026-87886 in targeted production intrusions to escape local user restrictions.

Technical Analysis

The vulnerability is formally categorized under CWE-276 (Incorrect Default Permissions), which emerges when software components create critical operational resources with overly permissive access control configurations:

Vulnerability Architecture & Insecure File Permissions

The Acronis backup integration operates with elevated system rights to interact with low-level Linux storage drivers, partition tables, and server configurations:

• Flawed Permission Assignment (CWE-276): During regular backup staging, configuration parsing, or communication handshake operations between the control panel UI and the Acronis backup agent, the plugin generates temporary file structures, sockets, or configuration paths with insecure permission bits.
• Permission Exploitation (T1068, T1222.002): A local attacker possessing standard unprivileged user access on the Linux host can manipulate, overwrite, or symlink these improperly restricted files. Because the background backup agent processes these paths within a privileged root security context, malicious modifications result in arbitrary command execution under root credentials.
• Zero User Interaction Required: Under CVSS vector metrics (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability requires only low privileges, features low attack complexity, and triggers completely asynchronously without administrative interaction.

Threat Modeling in Shared Hosting Environments

The presence of a local privilege escalation flaw on multi-tenant web servers presents an acute architectural risk:

• Tenant Boundary Collapse: Commercial shared hosting platforms co-locate hundreds of isolated tenant accounts on a single operating system instance. An attacker who compromises a single vulnerable CMS instance (such as a WordPress site with weak credentials or an unpatched plugin) obtains local shell or PHP execution.
• Immediate Host Takeover: By executing an exploit payload targeting CVE-2026-87886, the attacker pivots from a restricted tenant container directly into root supervisor authority, breaking multi-tenant isolation.

Attack Vector & Impact

Acronis confirmed that exploitation has been detected in targeted attacks against production environments:

• Confirmed Active Weaponization: In an official disclosure statement, Acronis acknowledged detecting in-the-wild exploitation against cPanel & WHM deployments, initially surfaced through a verified customer incident report.
• Total Data Confidentiality & Integrity Loss (T1005): With root privileges achieved via the backup integration, adversaries can inspect and extract unencrypted backup snapshots, MySQL/PostgreSQL databases, customer email archives, and SSL/TLS private keys across all hosted domains.
• Backup Tampering & Ransomware Threat (T1485): Because the compromised component controls disaster recovery archives, threat actors can alter backup configurations, exfiltrate master cloud storage tokens, or silently wipe recovery snapshots prior to deploying server-wide ransomware.

Detection & Mitigation

Because active exploitation is occurring in production environments, hosting providers and system administrators must deploy vendor-supplied updates immediately:

Immediate Patch Requirements

• Acronis Backup Plugin for cPanel & WHM: Upgrade all servers running builds earlier than 1.9.3.1021 to version 1.9.3 HF3 (build 1.9.3.1021 or later).
• Acronis Backup Extension for Plesk: Upgrade all installations running builds earlier than 1.8.11.638 to version 1.8.11 (build 1.8.11.638 or later).
• Automated Update Verification: Verify that automated update routines across WHM and Plesk have completed successfully by inspecting plugin build versions directly from the command line or administrative dashboards.

Host Auditing & Compromise Assessment

• File Permission Auditing: Inspect directories utilized by Acronis backup daemons (including /var/lib/Acronis/ and /usr/local/cpanel/3rdparty/) for unusual permissions, world-writable file descriptors, or dangling symbolic links.
• Linux Security Logging: Review auditd, /var/log/secure, and /var/log/messages for unauthorized process spawns where unprivileged web accounts (e.g. cpanel, nobody, or local tenant UIDs) spawn interactive shells (bash, sh, python) with elevated UID 0 permissions.
• Token and Credential Rotation: As a defense-in-depth measure, hosting providers that identify suspicious file activity should rotate all control panel administrative credentials, database root passwords, and Acronis cloud API integration keys.