Acronis patches a privilege escalation in its cPanel, Plesk and DirectAdmin backup plugins

September 16, 2026. CISA adds CVE-2026-87886 to its KEV catalog — a local privilege escalation in the Acronis Backup plugins for hosting control panels. September 17, 2026. The NVD publishes the entry: the cause is an incorrect default permission (CWE-276), rated CVSS 7.8. September 19, 2026. That is the deadline set for US federal agencies — a date already five days past as you read this. Why it matters: a backup product is the last line of defense against ransomware. A privilege escalation inside that product lets an attacker reach root, then wipe or encrypt the very backups meant to protect you.

The flaw: overly permissive default permissions

CVE-2026-87886 is not an injection flaw or a memory corruption. It is a CWE-276 — Incorrect Default Permissions. In plain terms, the components Acronis installs create files or directories with permissions looser than necessary, letting a low-privileged local user elevate all the way to the administrator account.

The scope covers three integrations built for web-hosting control panels:

The vector is local (AV:L), which might suggest moderate risk. It is the opposite: on a shared hosting server, a local user is exactly what an attacker obtains by compromising a single hosted site. The escalation then turns a low-level compromise into full control of the machine.

A backup product is not like other software

What makes this flaw a priority is the nature of the affected product. The Acronis Backup plugins have one job: keep a restorable copy of a server’s data and configuration, precisely for the scenario where everything else is lost — ransomware, outage, accidental deletion.

A privilege escalation inside that product inverts the logic entirely. The attacker does not need to bypass the backup: they use it. Once root, they can disable backup jobs, delete restore points, or worse, encrypt the backups at the same time as the production data, then demand a ransom for both. The backup, meant to be the escape hatch, becomes another lever in the attacker’s hands.

This is exactly the scenario modern ransomware has learned to target. The most advanced groups no longer stop at encrypting production data: they actively hunt for backup systems to destroy them before deploying encryption. A flaw that eases access to those systems is therefore a damage multiplier, not an isolated security incident.

Shared hosting makes it worse

The three affected products — cPanel & WHM, Plesk, DirectAdmin — are control panels for shared hosting. That means a single server hosts hundreds of accounts belonging to separate customers, each with its own system user but separated by privilege boundaries.

In that model, isolation between accounts is the security boundary. A local privilege escalation tears it down: an attacker who compromises one site — say through a vulnerable WordPress plugin or a weak password — gets a user shell, then exploits CVE-2026-87886 to reach root. From there, they read the databases and files of every customer on the box, and compromise everyone’s backups.

For a hoster, the cost is not a single customer to rebuild but a collective incident: notifying every tenant, reconstructing backups, losing trust. That is why a local flaw on this kind of software deserves immediate attention, despite its 7.8 score placing it “high” rather than “critical”.

There is a reason a local flaw lands on a federal must-patch list. On multi-tenant infrastructure, the local/remote distinction collapses the moment a single tenant is breached, and shared hosting is breached constantly — vulnerable WordPress plugins, exposed phpMyAdmin instances, and credential stuffing are routine entry points. CVE-2026-87886 is the bridge that turns one of those routine events into a box-wide takeover, which is exactly the escalation chain CISA’s KEV program is designed to short-circuit.

Verify and remediate

The fix is an update of the three integrations to the builds listed above. Verification is two-step: identify the installed version, then audit the actual permissions the old build left behind.

# Identify the installed plugin version (adjust the package name to your panel)
rpm -qa 2>/dev/null | grep -i acronis || dpkg -l 2>/dev/null | grep -i acronis

# Audit world-writable files under the panel directories
find /usr/local/cpanel /usr/local/psa /usr/local/directadmin \
  -type f -perm -o+w 2>/dev/null | head -20

The second command matters: the fix does not retroactively “repair” the already-too-loose permissions left by the old version. After upgrading, any world-writable file (-o+w) under the backup or panel directories must be reviewed and tightened. The update fixes the cause; the audit handles the consequences already in place.

The KEV listing is not currently accompanied by a public indicator of an associated ransomware campaign — CISA marks the “known ransomware use” field as unknown. That does not reduce the urgency: a catalog entry means CISA has evidence of real-world exploitation, and the September 19 deadline already reflected that severity.

Consider a concrete case. A shared hoster runs the Acronis Backup plugin for cPanel at build 1.9.2.900 — just below the fixed threshold. An attacker lands on one tenant’s outdated WordPress site, gets a shell as that tenant’s user, and exploits CVE-2026-87886 through a world-writable directory the plugin left behind. Within minutes they are root, and the first thing they do is enumerate the backup jobs and delete the restore points for every tenant on the node. The incident is invisible to the other tenants — who only discover the damage when they try, and fail, to restore.

The precedent: ransomware targets backups first

This CVE’s logic does not come from nowhere. For years, ransomware groups have folded backup into their attack playbook: destroy or encrypt the recovery copies before deploying production encryption, eliminating any chance of restoring without paying. CISA and partner agencies document this repeatedly in their StopRansomware advisories, and the KEV catalog has long carried flaws in backup products — Veeam, Backup Exec, Acronis — precisely because attackers exploit them in the wild.

In that context, a CWE-276 in a backup plugin is not a cosmetic bug. It hands the attacker the shortest path to the objective they already pursue: privileged access to the machine that holds the backups. The fact that the vector is local changes nothing on a shared hosting server, where obtaining a user shell is the routine consequence of a website compromise.

The lesson for teams is a matter of posture: backups deserve the same rigor as production. That means least-privilege permissions on backup files, compartmentalized service accounts, strong authentication on the backup console, and tested restores on a schedule — because a backup you have never restored is not a backup, it is a hope.

Verdict

CVE-2026-87886 illustrates a truth security teams underrate: backup is part of the attack surface, not just the recovery plan. If you host sites on cPanel, Plesk or DirectAdmin with the Acronis plugins, update all three integrations now — the federal deadline has already passed — then audit the residual permissions with the find command above. If you are a shared hoster, treat this flaw as a potentially collective incident: a local escalation on a shared node compromises all your tenants at once. Either way, apply the rule this CVE restates: the default permissions of a backup product are a security asset in their own right, not an installation detail.

References

• Acronis — Security Advisory SEC-10986 (September 16, 2026)
• NVD — CVE-2026-87886 (September 17, 2026)
• CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-87886 (September 16, 2026)