A permissions bug, not a network flaw
Acronis has patched a privilege escalation vulnerability in its Backup software that CISA confirms is being actively exploited, and the timeline between disclosure and required action was unusually short. The vulnerability, tracked as CVE-2026-87886, carries a CVSS score of 7.8 and stems from incorrect default file permissions rather than a network-facing coding error. It affects the Acronis Backup plugin for cPanel and WHM (Web Host Manager, the control panel hosting providers use to manage cPanel accounts) on Linux, and the equivalent Acronis Backup extension for Plesk, another widely used hosting control panel, also on Linux.
Because the flaw is a local privilege escalation issue rather than a remotely exploitable one, an attacker needs an existing low-privilege foothold on the server first, for example through a compromised cPanel account, before they can use this bug to climb to root. That distinction matters for how urgent this is: it is not a way to break into a server from the outside, but it is a way to turn a minor compromise into a total one, which is precisely why it is dangerous on shared hosting infrastructure where many low-privilege accounts sit on the same machine.
What is confirmed, and what isn't
Acronis has not published technical detail on how the incorrect permissions can be abused, pointing customers instead to its own advisory, tracked internally as SEC-10986. The company has confirmed active exploitation, but only against the cPanel and WHM version of the plugin. The Plesk extension carries the same underlying flaw and the same CVE, but Acronis and outside reporting have not confirmed exploitation against it specifically. Nothing has been said publicly about who is behind the attacks or what they are after once they escalate privileges.
The fix arrived in build 1.9.3.1021 or later for the cPanel and WHM plugin, and build 1.8.11.638 or later for the Plesk extension. Anything running an earlier build on Linux is exposed.
CISA gave federal agencies three days
CISA added CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalog on September 16, 2026, with a remediation due date of September 19, 2026, a three-day window. That is a short turnaround even by KEV standards, and it reflects how the catalog is meant to work: entry is reserved for vulnerabilities CISA has confirmed are already being exploited, not ones that are merely serious in theory, and the required response speed scales with how much active harm is already happening.
The KEV requirement is legally binding only on U.S. federal civilian agencies, under Binding Operational Directive 26-04, but the catalog functions as a de facto priority list well beyond government. Hosting providers and managed service providers running Acronis Backup on Linux cPanel, WHM, or Plesk installations should treat the September 19 date as having already passed and patch immediately rather than waiting for a formal mandate that does not apply to them anyway.
Why this one is easy to miss
Backup software occupies an unusual position in most patch management programs. It typically runs with elevated privileges by design, because it needs broad filesystem access to do its job, and it is often treated as infrastructure plumbing that gets installed once and left alone rather than tracked the way customer-facing applications are. That combination, high privilege plus low visibility, is exactly the profile that makes a permissions bug in a backup plugin more dangerous than its CVSS score alone suggests. A 7.8 score sits below the "critical" band most organizations reserve for emergency out-of-cycle patching, but a local privilege escalation bug in something running as root on a shared hosting box, already being exploited, does not deserve to wait for the next scheduled maintenance window.
What this means in practice
Anyone administering Linux servers with cPanel, WHM, or Plesk should check whether the Acronis Backup plugin or extension is installed at all, since it is sometimes bundled by hosting providers without the account holder actively choosing it. If it is present, confirm the build number against the fixed versions above, cPanel and WHM need 1.9.3.1021 or newer, Plesk needs 1.8.11.638 or newer, and update immediately if it is older. Given that Acronis has withheld exploitation technical detail, there is no reliable way to check logs for signs of prior compromise beyond general privilege escalation monitoring, so treat any server that was running a vulnerable build as worth a closer look rather than assuming the absence of obvious symptoms means it was never touched.
