Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain

Part of the CVE-2026-87886 story · since 16 Sep

Quiet for 6 weekslast report 17 Sep3 articles3 outlets
16 Sep · SecurityWeek first10 Oct18 OctNowThis article1st of 3
  • Wed 16 Sep, 10:11 UTC. SecurityWeek, first report. Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain. Cites a CVE in CISA KEV. This article, 1st of 3.
  • Thu 17 Sep, 00:00 UTC. CISA, its first report on the story. CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.

Acronis has released urgent patches for a vulnerability in its Backup plugin for cPanel & WHM after detecting exploitation in limited, targeted attacks. The flaw, tracked as CVE-2026-87886 and rated 7.8 on the CVSS scale, involves insecure file permissions that could allow attackers to gain elevated privileges. The plugin provides disk-level backup and recovery capabilities in hosting-control-panel environments.

Acronis said exploitation has been confirmed against the cPanel & WHM plugin, but not against the corresponding Backup extension for Plesk. All Linux versions of the cPanel & WHM plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected. The company has not published technical details of the vulnerability, but is urging customers to update their deployments immediately to the fixed builds.

How the story developed

All 3 articles
Quiet for 6 weekslast report 17 Sep3 articles3 outlets

3 articles from 3 outlets since 16 Sep. Quiet since 17 Sep. This was the first report.

Now16 Sep17First reportSecurityWeek · 16 Sep, 10:11CISA alert17 Sep, 00:00 · official
  • Wed 16 Sep, 10:11 UTC. SecurityWeek, first report. Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain. Cites a CVE in CISA KEV. This article, 1st of 3.
  • Thu 17 Sep, 00:00 UTC. CISA, its first report on the story. CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation. Cites a CVE in CISA KEV.
  • Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Wed 16 SepDay 01
    1. Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain10:11 · SecurityWeek · First report · Exploited CVE · Known exploited CVE · This article, 1st of 3
  2. Thu 17 SepDay 12
    1. CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation00:00 · CISA · official · CISA alert · Known exploited CVE
    2. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in