Acronis backup plugins for cPanel and Plesk patch privilege escalation flaw CVE-2026-87886

The vulnerability

Acronis has shipped fixed builds of its backup integrations for two widely deployed hosting control panels after the disclosure of a high-severity privilege escalation flaw. The vulnerability, tracked as CVE-2026-87886, affects the Acronis Backup plugin for cPanel & WHM on Linux and the Acronis Backup extension for Plesk on Linux.

According to a technical write-up on dev.to, India's CERT-In published the issue as vulnerability note CIVN-2026-0466 on 18 September 2026 with a HIGH severity rating, and Acronis documents the fix in advisory SEC-10986. The vulnerable versions are the cPanel & WHM plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638; hosts already on those builds or newer fall outside the advisory.

The root cause, per CERT-In as summarised by dev.to, is weak file permission handling in the plugins. These integrations embed Acronis cloud backup features directly into cPanel, WHM and Plesk and run with elevated rights on the hosting node, so any file they trust becomes a target for a lower-privileged user able to read or modify it. The dev.to analysis frames the practical failure as files whose ownership or mode lets a local user tamper with content the plugin later processes in a privileged context.

Conditions for exploitation

Two preconditions shape the risk. The attacker needs an existing presence on the host: CERT-In describes exploitation by a remote attacker who already has access to the target, so this is not a pre-authentication strike against an exposed panel. And the affected plugin must be installed on that host. On shared hosting, dev.to notes, one compromised customer account may be all it takes to meet the first condition, which is what turns a local escalation in a panel component into an operational problem.

There is no sign the flaw is under active abuse. No public proof of concept exists and no exploitation has been confirmed, so the mechanism is established by the advisory rather than by a working exploit.

Impact

According to CERT-In, a successful attacker can lift their privileges, run code of their choosing, or take actions on the machine they were never authorised to perform. On a hosting node that can extend to the panel itself and, potentially, to other tenants sharing the hardware. Backup components are especially sensitive because they routinely handle credential material and data spanning many accounts at once.

Sizing the exposure

dev.to warns against equating panel counts with risk. A ZoomEye query for the cPanel fingerprint returns a very large population of internet-facing instances, but that measures how common the panel is, not how many hosts run the vulnerable plugin build. The exposure question operators actually need to answer is which of their managed hosts have the Acronis plugin installed and at which build. Panels and plugins are versioned independently, so the plugin build, not the panel version, determines scope.

Remediation and mitigation

The write-up recommends upgrading the cPanel & WHM plugin to build 1.9.3.1021 or later and the Plesk extension to build 1.8.11.638 or later, following advisory SEC-10986. After upgrading, administrators should verify the installed build and confirm that ownership and permissions on plugin directories match vendor expectations. Further hardening steps include limiting which local accounts can access the plugin's files, checking whether any non-administrative user can write to plugin-managed paths, and reviewing logs for escalation attempts around the plugin. Where immediate patching is not possible, isolate the plugin from lower-privileged users and monitor its files for unauthorised modifications. A compromised customer account on an affected host should be treated as a possible precursor to host-level compromise.

Why it matters

A privilege escalation inside a hosting panel component attacks the very separation between an individual tenant and the host running everyone else's sites. Backup plugins raise the stakes further because they are privileged by design and touch credentials belonging to many accounts. The fix here is cheap relative to the risk: check a build number, upgrade, and re-verify permissions. A host-level compromise discovered late is not cheap. Operators running either integration should make build verification an immediate task.