Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE

What to do

1. Inventory every cPanel & WHM, Plesk and DirectAdmin server with the Acronis Backup plugin or extension installed.
2. Update cPanel & WHM servers to plugin 1.9.3 HF3 (build 1.9.3.1021) or later first, since that is where exploitation was seen.
3. Update the Plesk extension to 1.8.11 (build 1.8.11.638) and the DirectAdmin plugin to build 1.2.3.238 or later.
4. Confirm the installed build on each server after updating rather than trusting automatic updates.
5. On shared-hosting servers, review which users and sites have shell or script execution, and hunt for signs of local compromise.

How to check if you are affected or compromised

• Check the installed plugin or extension build on each server (for Plesk, plesk bin extension --list) against the fixed builds.
• Look for web shells and unexpected scripts in customer document roots, the most likely source of a local foothold on hosting servers.
• Hunt for new setuid binaries, unknown cron jobs, unexpected root SSH keys and recently modified files in the Acronis plugin directories.
• Acronis has published no indicators of compromise as of Oct 21, 2026; treat any confirmed local compromise on an unpatched cPanel server as possible root-level compromise.

What happened#

Acronis has disclosed CVE-2026-87886, a local privilege escalation in its Backup integrations for web hosting control panels. Advisory SEC-10986 calls it "local privilege escalation due to insecure file permissions" (CWE-276), rated CVSS 3.0 7.8. It also states: "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments."

The fixes shipped quietly before the disclosure. The Plesk extension 1.8.11 update is dated September 10 and the cPanel & WHM plugin 1.9.3 HF3 update September 11. On September 15, Acronis revised both entries to link SEC-10986. The cPanel note now says the update "should be installed immediately by all users" and repeats the exploitation warning. The Plesk note says Acronis sees "no signs of active exploitation." CISA added the CVE to the KEV catalog on September 16, with a federal deadline of September 19. The CVE record was published on September 17.

Who is affected#

Three Linux products are affected:

• Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 (fixed in 1.9.3 HF3)
• Acronis Backup extension for Plesk before build 1.8.11.638
• Acronis Backup plugin for DirectAdmin before build 1.2.3.238

CISA's KEV entry names only the cPanel and Plesk products. The vendor advisory and the CVE record include DirectAdmin as well. No other Acronis products are listed in SEC-10986.

Do you really need to act?#

Most developers and companies can skip this one. It matters only if you run hosting servers with one of these panel integrations installed. If you do, the "local" in local privilege escalation offers less comfort than it sounds. The CVSS vector requires low privileges and no user interaction. On a shared cPanel server, low privileges describe every hosting customer, and every website whose CMS or plugin an attacker can turn into a web shell. Escalating from there threatens every tenant on the box, and the backups too. CISA's enrichment on the CVE record rates the technical impact "total" and automatability "no," consistent with a second-stage bug used after an initial foothold.

Very little is known about the attacks. The Hacker News reports there are no details on the attackers, their goals, or how long exploitation went on, and an Acronis spokesperson had "nothing to add at this stage." Help Net Security likewise says it is unknown what attackers do after escalating. As of October 21, 2026, there is no public proof-of-concept and no published root-cause write-up.

What to do now#

1. List every cPanel & WHM, Plesk and DirectAdmin server with the Acronis Backup integration installed. On Plesk, plesk bin extension --list shows installed extensions and versions. On cPanel or DirectAdmin hosts, check the plugin's version in the panel, or with rpm -qa | grep -i acronis where it is packaged as an RPM.
2. Update cPanel & WHM servers to 1.9.3 HF3 (build 1.9.3.1021) or later first.
3. Update Plesk to 1.8.11 (build 1.8.11.638) and DirectAdmin to build 1.2.3.238 or later.
4. Re-check the installed build afterward. Don't assume the update arrived.
5. On multi-tenant servers, take stock of which accounts have shell access or can run scripts, and tighten that where you can.

How to tell if you were hit#

Acronis has not published indicators of compromise as of October 21, 2026, so hunting means looking for local escalation in general. Start where a local attacker would get in: web shells and unfamiliar scripts in customer document roots. Then look for what escalation leaves behind: new setuid binaries (find / -xdev -perm -4000 -mtime -60), unknown root cron jobs, keys you didn't add in /root/.ssh/authorized_keys, and recently modified files in the Acronis plugin's install directories. If you find a confirmed local compromise on a cPanel server that ran a vulnerable build, assume root-level access. Rebuild the host, then rotate panel, database and backup-storage credentials.

Timeline#

• Sep 10, 2026 — Acronis releases the fixed Plesk extension, 1.8.11.
• Sep 11, 2026 — Acronis releases the cPanel & WHM plugin 1.9.3 HF3.
• Sep 15, 2026 — Acronis updates both entries, links SEC-10986 and reports exploitation against cPanel & WHM.
• Sep 16, 2026 — CISA adds the CVE to KEV (due Sep 19).
• Sep 17, 2026 — The CVE record is published.

Vulnerability records

• CVE-2026-87886 · KEV 2026-09-16 · Local privilege escalation due to insecure file permissions.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Acronis — Security advisory SEC-10986 (CVE-2026-87886) security-advisory.acronis.com
2. Acronis — Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3 security-advisory.acronis.com
3. Acronis — Acronis Backup extension for Plesk version 1.8.11 security-advisory.acronis.com
4. CVE record — CVE-2026-87886 cve.org
5. CISA — Known Exploited Vulnerabilities: CVE-2026-87886 cisa.gov

Coverage and analysis

1. The Hacker News — Acronis cPanel backup plugin flaw exploited thehackernews.com
2. Help Net Security — Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886) helpnetsecurity.com