Is CVE-2026-87886 exploited in the wild?

Yes. CVE-2026-87886 is known to be exploited in the wild, first recorded on 16 September 2026. Treat it as urgent.

How severe is CVE-2026-87886?

Critical severity, with a CVSS score of 7.8, published 17 September 2026.

Which products and versions are affected?

Acronis Backup plugin for cPanel & WHM; Acronis Backup extension for Plesk.

Is there a fix for CVE-2026-87886?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87886 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-87886?

Check whether you run Acronis Backup Extension for Plesk or Acronis Backup Plugin for cPanel & WHM. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87886: Acronis Backup privilege escalation in cPanel/WHM and Plesk plugins

CVE-2026-87886 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-09-17

Acronis Backup, a widely-used data protection solution, has plugins for popular web hosting control panels (cPanel/WHM and Plesk) that are installed with overly permissive default settings. An attacker with local access to a hosting environment could exploit these incorrect permissions to escalate privileges and gain unauthorized control over backup operations or hosted customer data. This vulnerability is actively being exploited in the wild.

Vendors: Acronis.

Quick answers

Is CVE-2026-87886 exploited in the wild?: Yes. CVE-2026-87886 is known to be exploited in the wild, first recorded on 16 September 2026. Treat it as urgent.
How severe is CVE-2026-87886?: Critical severity, with a CVSS score of 7.8, published 17 September 2026.
Which products and versions are affected?: Acronis Backup plugin for cPanel & WHM; Acronis Backup extension for Plesk.
Is there a fix for CVE-2026-87886?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87886 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-87886?: Check whether you run Acronis Backup Extension for Plesk or Acronis Backup Plugin for cPanel & WHM. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Acronis Backup plugins for cPanel/WHM and Plesk control panels are installed with incorrect default file or directory permissions that fail to properly restrict access. This misconfiguration allows an attacker with local system access (e.g., a compromised hosting account or low-privileged process) to read, modify, or execute protected files, leading to privilege escalation. The vulnerability does not require authentication to the control panel itself, only filesystem-level access. Successful exploitation could grant an attacker elevated privileges to manage backups, access customer data, or compromise the hosting infrastructure. The vulnerability has been observed exploited in active attacks. Patches or configuration updates from Acronis addressing the default permissions are recommended.

Affected products

Acronis Backup plugin for cPanel & WHM
Acronis Backup extension for Plesk

Timeline

2026-09-16: disclosed: CVE-2026-87886 published
exploited: Actively exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.