CVE-2026-87886 Acronis CVE debrief

Who should care

System administrators and security teams responsible for Acronis Backup installations, especially those with internet-exposed management interfaces, should assess their exposure and prioritize patching or mitigation efforts.

Why it matters

CVE-2026-87886 is a high-severity local privilege escalation vulnerability in Acronis Backup plugins. Defenders should verify exposure, prioritize patching, and monitor for suspicious activity.

• Potential local privilege escalation requires verification from official sources.
• Defenders should verify exposure in their environments and prioritize patching or mitigation.

Technical summary

The vulnerability exists in Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin on Linux systems due to insecure file permissions. Affected versions include those before 1.9.3.1021 for cPanel & WHM, 1.8.11.638 for Plesk, and 1.2.3.238 for DirectAdmin. The CVSS score for this vulnerability is 7.8, indicating a high severity level. Defenders should prioritize patching or mitigating this vulnerability, especially for systems with internet-exposed management interfaces, and verify exposure in their environments.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems with internet-exposed management interfaces.

Recommended defensive actions

• Patch Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin to the latest versions.
• Restrict access to management interfaces to trusted users only.
• Monitor systems for suspicious activity related to privilege escalation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 7.8 and affected software versions. The vulnerability has been cataloged by CISA as known to be exploited in the wild. Defenders should verify exposure in their environments and prioritize patching or mitigation. The vendor has provided advisory information for affected products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.