Acronis Backup Plugin for cPanel & WHM Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- acronis backup (npm)
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the Acronis Backup plugin for cPanel & WHM and extension for Plesk. This vulnerability, tracked as CVE-2026-87886, could allow for privilege escalation.
What happened
Acronis has reportedly warned of a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments. The vulnerability, tracked as CVE-2026-87886, is described as a case of local privilege escalation due to insecure file permissions. This flaw affects versions of the Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and the Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Successful exploitation could allow an attacker with low privileges to escalate their permissions on a susceptible Linux version, potentially enabling them to perform unauthorized actions or run arbitrary code that could impact the confidentiality and integrity of the application.
The vulnerability has been detected in the wild in limited, targeted attacks. There are currently no details about the vulnerability, or who is behind the attacks exploiting it and what the end goals are. It's also not clear when the activity was detected and since when the security flaw may have been exploited in the wild. Acronis has noted that this update contains fixes for 1 high-severity security vulnerability and should be installed immediately by all users.
What to do about it
- Upgrade to the latest version of Acronis Backup immediately.
- Review and adjust permissions for cPanel & WHM and Plesk extensions to ensure they are secure.
- Monitor the primary sources for updates on the vulnerability and any additional fixes that may be released.
- No official fix has been published yet for the affected components. Monitor the sources below for updates.
How 0Day would have caught this
acronis backup is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using versions of the Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 or the Acronis Backup extension for Plesk (Linux) before build 1.8.11.638.
What should I do right now?
Upgrade to the latest version of Acronis Backup and review permissions for cPanel & WHM and Plesk extensions.
Has this been exploited in the wild?
Yes, the vulnerability has been reportedly exploited in the wild in limited, targeted attacks.