CISA KEV alertCyberSIXT
CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation
Part of the CVE-2026-87886 story · since 16 Sep
- Wed 16 Sep, 10:11 UTC. SecurityWeek, first report. Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain. Cites a CVE in CISA KEV.
- Thu 17 Sep, 00:00 UTC. CISA, its first report on the story. CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation. Cites a CVE in CISA KEV. This article, 2nd of 3.
- Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
CISA has added CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Acronis Backup, specifically the plugin for cPanel & WHM and the extension for Plesk. Named the Acronis Backup Incorrect Default Permissions Vulnerability, it could allow an attacker to escalate privileges.
The flaw involves incorrect default permissions in Acronis Backup components. The available description indicates a privilege-escalation impact, but does not provide further technical details about the attack vector or exploitation requirements. No CVSS score or severity rating is currently available. Patch status is also unknown, and no patch advisory was provided in the supplied data. Organisations should consult Acronis advisory SEC-10986 for vendor guidance.
CISA’s KEV listing confirms that the vulnerability has been exploited in the wild. The available data does not confirm whether CVE-2026-87886 has been used in ransomware campaigns. Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by 19 September 2026.
CISA requires agencies to apply mitigations in accordance with vendor instructions, while following the requirements of BOD 26-04, Prioritising Security Updates Based on Risk, and CISA’s Forensics Triage Requirements. Agencies must apply the relevant BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must assess each asset’s internet exposure and comply with BOD 26-04 patching guidance.
Although the deadline applies directly to FCEB agencies, all organisations should review their exposure to Acronis Backup deployments using cPanel & WHM or Plesk.
See the NVD entry for CVE-2026-87886 and CISA’s KEV catalogue for full details: https://nvd.nist.gov/vuln/detail/CVE-2026-87886 and https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
How the story developed
3 articles from 3 outlets since 16 Sep. Quiet since 17 Sep. This was the 2nd report, 14 hours after the first.
- Wed 16 Sep, 10:11 UTC. SecurityWeek, first report. Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain. Cites a CVE in CISA KEV.
- Thu 17 Sep, 00:00 UTC. CISA, its first report on the story. CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation. Cites a CVE in CISA KEV. This article, 2nd of 3.
- Thu 17 Sep, 10:42 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 3 articles as a listHide the list
- Wed 16 SepDay 01
- Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain10:11 · SecurityWeek · First report · Exploited CVE · Known exploited CVE
- Thu 17 SepDay 12
- CISA Flags Exploited Acronis Backup Flaw Allowing Privilege Escalation00:00 · CISA · official · CISA alert · Known exploited CVE · This article, 2nd of 3
- CISA Flags Actively Exploited Cisco, Acronis and Pixel Flaws10:42 · Security Affairs · Known exploited CVE