Acronis Backup Plugins Local Privilege Escalation Advisory (CVE-2026-87886) - cPanel, Plesk, DirectAdmin

Follow the instructions below based on your hosting control panel:

1. cPanel & WHM

Update the plugin via the package manager:

yum update acronis-backup-cpanel

2. Plesk

Update via the Plesk Extension catalog or use the CLI:

plesk bin extension --update acronis-backup

3. DirectAdmin

Run the update script provided by Acronis or re-run the installation script to fetch the latest build.

4. Verification

Ensure that no sensitive binaries under the Acronis path are world-writable:

ls -l /usr/local/acronis/bin/ # Check for suspicious 777 or 666 permissions

CVE-2026-87886 is a critical Local Privilege Escalation (LPE) vulnerability caused by Insecure Default Permissions (CWE-276) within Acronis Backup plugins for Linux hosting environments. The vulnerability allows a low-privileged local user—common in multi-tenant shared hosting scenarios—to manipulate files or binaries that were deployed with overly permissive access rights. By exploiting these permissions, an attacker can execute arbitrary code with the privileges of the backup service, typically root. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and maintains an EPSS score of 0.94, indicating a very high probability of active exploitation in the wild.