Acronis’s backup integrations for the three most widely deployed Linux hosting control panels — cPanel & WHM, Plesk, and DirectAdmin — ship a privilege-escalation bug that’s already being used against production hosts. CVE-2026-87886 carries a CVSS score of 7.8 and stems from insecure default file permissions (CWE-276) in how the plugin handles temporary files, logs, and backup archives.

What happened

The Acronis Backup plugin runs with elevated privileges to do its job — reading and writing backup data across every account on a hosting server. The problem is what permissions it leaves behind on the files it touches. Instead of restricting temp files, log entries, and archive metadata to the privileged service account, the plugin creates them world-readable and, in some cases, world-writable (permissions like 0644 or looser). Any local user on the box — including an unprivileged hosting account — can read or tamper with those files.

That’s a local bug until you remember what “local user” means on shared hosting: a customer account, or an attacker who popped a single WordPress site on the server through an unrelated web app vulnerability or a leaked SSH key. From that low-privilege foothold, the attacker abuses the loosely permissioned backup files to escalate to the privileged account the plugin runs as — root, in practice, on affected deployments.

Acronis published the advisory (SEC-10986) on September 15, 2026. Confirmed reports of exploitation in the wild followed within a day, described as limited but targeted attacks specifically against cPanel & WHM deployments. CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities catalog on September 16, 2026, with a federal remediation deadline of September 19, 2026 — tomorrow, for agencies running the affected software.

Affected versions and fix

  • Acronis Backup plugin for cPanel & WHM (Linux): before build 1.9.3.1021 — fixed in 1.9.3 HF3
  • Acronis Backup extension for Plesk (Linux): before build 1.8.11.638 — fixed in 1.8.11
  • Acronis Backup plugin for DirectAdmin (Linux): before build 1.2.3.238

Update all three plugin variants to their fixed builds. There is no supported workaround short of patching — restrictive umask changes or manual permission fixes on plugin-managed files won’t survive the plugin’s own file operations and aren’t an Acronis-endorsed mitigation.

Impact

This isn’t a single-tenant bug. cPanel & WHM, Plesk, and DirectAdmin are the control-plane software for a large share of the internet’s shared and reseller hosting — one physical or virtual server routinely hosts dozens to hundreds of unrelated customer accounts. A privilege-escalation primitive on that stack means one compromised low-value site (a stale WordPress install, a forgotten subdomain, a weak SSH key on any single account) becomes a path to root on the entire host.

Once an attacker has root on a shared hosting server, every other tenant on that box is exposed: their databases, credentials, TLS private keys, backup archives, and site files are all readable, and the attacker can plant persistence that survives individual account cleanups. For hosting providers and MSPs running Acronis-integrated panels, this is a multi-tenant blast-radius problem, not an isolated CVE affecting a single customer.

Mitigation

  • Patch immediately to the fixed build for whichever panel integration you run — 1.9.3 HF3 (cPanel/WHM), 1.8.11 (Plesk), or the current DirectAdmin build past 1.2.3.238.
  • Audit for prior exploitation on cPanel & WHM hosts specifically, since that’s where confirmed attacks have been observed: look for unexpected root-owned processes spawned from web-facing accounts, new SSH keys or cron entries added outside normal change windows, and modified permissions on Acronis plugin temp/log/backup paths.
  • Review multi-tenant blast radius if you’re a hosting provider — treat any server that was running a vulnerable plugin build as requiring a full tenant-isolation review, not just a plugin update, given how long the insecure permissions may have been exploitable before the September 15 advisory.
  • Rotate credentials and re-issue TLS certificates for any tenant on a server where root compromise is suspected, since a root-level attacker on a shared host can extract private keys and stored secrets for every account, not just the one initially breached.
  • Federal agencies: CISA’s KEV listing sets a September 19, 2026 remediation deadline under BOD 22-01; treat this as a same-week patch regardless of sector given active, if limited, exploitation.

Acronis’s advisory SEC-10986 has the authoritative build matrix and hotfix download links; check it directly before patching to confirm you’re pulling the correct fixed build for your panel integration.