ACRONIS has released urgent patches for a vulnerability in its Backup plugin for cPanel & WHM after detecting exploitation in limited, targeted attacks. The flaw, tracked as CVE-2026-87886 and rated 7.8 on the CVSS scale, involves insecure file permissions that could allow attackers to gain elevated privileges. The plugin provides disk-level backup and recovery capabilities in hosting-control-panel environments.
Acronis said exploitation has been confirmed against the cPanel & WHM plugin, but not against the corresponding Backup extension for Plesk. All Linux versions of the cPanel & WHM plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected. The company has not published technical details of the vulnerability, but is urging customers to update their deployments immediately to the fixed builds.