CVE-2026-87886

Timeline

Detection, updates, and resolution for this record.

1. Sep 16, 2026 · Catalog

   Detected

   Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

2. Sep 16, 2026 · CISA KEV

   Known exploited

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

3. Sep 18, 2026 · Catalog

   Updated

   Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

4. Sep 19, 2026 · CISA KEV

   Remediation due

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Affected

• cpe acronis/acronis backupversion unspecified
• cpe acronis/acronis backup1.9.3
• vendor Acronis Backupversion unspecified

Sources

• CISA KEVCVE-2026-87886

  Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

  cisa.gov
• CVE.orgCVE-2026-87886

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2026-87886

  30-day exploitation probability 0.2%

  first.org
• NIST NVDCVE-2026-87886

  Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Lin

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · security-advisory.acronis.com
• US Government Resource · cisa.gov
• CISA note · cisa.gov
• CISA note · cisa.gov