---
title: "Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE"
url: https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/
description: "Insecure file permissions in Acronis Backup for cPanel & WHM, Plesk and DirectAdmin allow local privilege escalation, exploited on cPanel. Update the plugin."
type: security-brief
section: "Security Digest"
date_published: 2026-09-15
date_modified: 2026-09-17
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-87886"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Acronis Backup cPanel Plugin CVE-2026-87886: Exploited LPE

**Verdict: Check exposure.** Only hosting servers running the Acronis Backup plugin for cPanel & WHM, Plesk or DirectAdmin are affected; on those, especially multi-tenant cPanel boxes, update the plugin now because it is being exploited.

- **Who must act:** Hosting providers and server admins with the Acronis Backup plugin or extension installed on Linux cPanel & WHM, Plesk or DirectAdmin servers, above all shared-hosting servers where many users or websites have local access.
- **Who can relax:** Everyone without these specific Acronis hosting-panel integrations, including users of other Acronis products not listed in SEC-10986.
- **Affected:** Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021; Acronis Backup extension for Plesk (Linux) before build 1.8.11.638; Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238
- **Fixed:** Acronis Backup plugin for cPanel & WHM 1.9.3 HF3 (build 1.9.3.1021); Acronis Backup extension for Plesk 1.8.11 (build 1.8.11.638); Acronis Backup plugin for DirectAdmin build 1.2.3.238
- **CVEs:** CVE-2026-87886
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every cPanel & WHM, Plesk and DirectAdmin server with the Acronis Backup plugin or extension installed.
2. Update cPanel & WHM servers to plugin 1.9.3 HF3 (build 1.9.3.1021) or later first, since that is where exploitation was seen.
3. Update the Plesk extension to 1.8.11 (build 1.8.11.638) and the DirectAdmin plugin to build 1.2.3.238 or later.
4. Confirm the installed build on each server after updating rather than trusting automatic updates.
5. On shared-hosting servers, review which users and sites have shell or script execution, and hunt for signs of local compromise.

### How to check if you are affected

- Check the installed plugin or extension build on each server (for Plesk, plesk bin extension --list) against the fixed builds.
- Look for web shells and unexpected scripts in customer document roots, the most likely source of a local foothold on hosting servers.
- Hunt for new setuid binaries, unknown cron jobs, unexpected root SSH keys and recently modified files in the Acronis plugin directories.
- Acronis has published no indicators of compromise as of Oct 21, 2026; treat any confirmed local compromise on an unpatched cPanel server as possible root-level compromise.

## What happened

Acronis has disclosed CVE-2026-87886, a local privilege escalation in its Backup integrations for web hosting control panels. Advisory [SEC-10986](https://security-advisory.acronis.com/advisories/SEC-10986) calls it "local privilege escalation due to insecure file permissions" (CWE-276), rated CVSS 3.0 7.8. It also states: "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments."

The fixes shipped quietly before the disclosure. The [Plesk extension 1.8.11](https://security-advisory.acronis.com/updates/UPD-2609-efb0-50b2) update is dated September 10 and the [cPanel & WHM plugin 1.9.3 HF3](https://security-advisory.acronis.com/updates/UPD-2609-3d72-20a7) update September 11. On September 15, Acronis revised both entries to link SEC-10986. The cPanel note now says the update "should be installed immediately by all users" and repeats the exploitation warning. The Plesk note says Acronis sees "no signs of active exploitation." CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886) on September 16, with a federal deadline of September 19. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-87886) was published on September 17.

## Who is affected

Three Linux products are affected:

- Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 (fixed in 1.9.3 HF3)
- Acronis Backup extension for Plesk before build 1.8.11.638
- Acronis Backup plugin for DirectAdmin before build 1.2.3.238

CISA's KEV entry names only the cPanel and Plesk products. The vendor advisory and the CVE record include DirectAdmin as well. No other Acronis products are listed in SEC-10986.

## Do you really need to act?

Most developers and companies can skip this one. It matters only if you run hosting servers with one of these panel integrations installed. If you do, the "local" in local privilege escalation offers less comfort than it sounds. The CVSS vector requires low privileges and no user interaction. On a shared cPanel server, low privileges describe every hosting customer, and every website whose CMS or plugin an attacker can turn into a web shell. Escalating from there threatens every tenant on the box, and the backups too. CISA's enrichment on the CVE record rates the technical impact "total" and automatability "no," consistent with a second-stage bug used after an initial foothold.

Very little is known about the attacks. [The Hacker News](https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html) reports there are no details on the attackers, their goals, or how long exploitation went on, and an Acronis spokesperson had "nothing to add at this stage." [Help Net Security](https://helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886) likewise says it is unknown what attackers do after escalating. As of October 21, 2026, there is no public proof-of-concept and no published root-cause write-up.

## What to do now

1. List every cPanel & WHM, Plesk and DirectAdmin server with the Acronis Backup integration installed. On Plesk, `plesk bin extension --list` shows installed extensions and versions. On cPanel or DirectAdmin hosts, check the plugin's version in the panel, or with `rpm -qa | grep -i acronis` where it is packaged as an RPM.
2. Update cPanel & WHM servers to 1.9.3 HF3 (build 1.9.3.1021) or later first.
3. Update Plesk to 1.8.11 (build 1.8.11.638) and DirectAdmin to build 1.2.3.238 or later.
4. Re-check the installed build afterward. Don't assume the update arrived.
5. On multi-tenant servers, take stock of which accounts have shell access or can run scripts, and tighten that where you can.

## How to tell if you were hit

Acronis has not published indicators of compromise as of October 21, 2026, so hunting means looking for local escalation in general. Start where a local attacker would get in: web shells and unfamiliar scripts in customer document roots. Then look for what escalation leaves behind: new setuid binaries (`find / -xdev -perm -4000 -mtime -60`), unknown root cron jobs, keys you didn't add in `/root/.ssh/authorized_keys`, and recently modified files in the Acronis plugin's install directories. If you find a confirmed local compromise on a cPanel server that ran a vulnerable build, assume root-level access. Rebuild the host, then rotate panel, database and backup-storage credentials.

## Timeline

- Sep 10, 2026 — Acronis releases the fixed Plesk extension, 1.8.11.
- Sep 11, 2026 — Acronis releases the cPanel & WHM plugin 1.9.3 HF3.
- Sep 15, 2026 — Acronis updates both entries, links SEC-10986 and reports exploitation against cPanel & WHM.
- Sep 16, 2026 — CISA adds the CVE to KEV (due Sep 19).
- Sep 17, 2026 — The CVE record is published.

## Sources

1. [Acronis — Security advisory SEC-10986 (CVE-2026-87886)](https://security-advisory.acronis.com/advisories/SEC-10986)
2. [Acronis — Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3](https://security-advisory.acronis.com/updates/UPD-2609-3d72-20a7)
3. [Acronis — Acronis Backup extension for Plesk version 1.8.11](https://security-advisory.acronis.com/updates/UPD-2609-efb0-50b2)
4. [CVE record — CVE-2026-87886](https://www.cve.org/CVERecord?id=CVE-2026-87886)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-87886](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886)
6. [The Hacker News — Acronis cPanel backup plugin flaw exploited](https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html)
7. [Help Net Security — Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)](https://helpnetsecurity.com/2026/09/16/acronis-backup-plugin-vulnerability-exploited-cve-2026-87886)

---
Source page: https://erroneo.us/security/briefs/acronis-backup-cpanel-plesk-lpe-cve-2026-87886/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt