As reported by BleepingComputer, Acronis has disclosed CVE-2026-87886, a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel/WHM and its extension for Plesk. The flaw carries a CVSS score of 7.8 and, critically, Acronis has confirmed exploitation in the wild — albeit described as "limited, targeted attacks."
While the vendor has withheld technical details to allow patching, the advisory alone tells defenders enough to understand the risk profile. This is not a remote code execution vector; it is a local privilege escalation. That distinction matters enormously for how you prioritize and respond.
Vulnerability Summary
| Field | Detail |
|---|---|
| CVE | CVE-2026-87886 |
| CVSS | 7.8 (High) |
| Type | Local Privilege Escalation (Linux) |
| Affected (cPanel/WHM) | Acronis Backup plugin builds earlier than 1.9.3.1021 |
| Fixed (cPanel/WHM) | Version 1.9.3 HF3 |
| Affected (Plesk) | Acronis Backup extension builds earlier than 1.8.11.638 |
| Fixed (Plesk) | Version 1.8.11 |
| Exploitation | Confirmed in the wild — limited, targeted attacks |
| IOCs | None published by vendor |
| User Interaction | Not required |
Why This Is Bigger Than a Typical LPE
Local privilege escalation vulnerabilities are common and often deprioritized in favor of remotely exploitable flaws. That would be a mistake here. The attack surface — shared hosting environments running cPanel/WHM and Plesk — changes the calculus significantly.
In a shared hosting model, a single physical or virtual server hosts dozens, hundreds, or even thousands of customer tenants. Each tenant typically operates with a low-privileged Linux account. A privilege escalation flaw on such a system can mean the difference between compromising one website and compromising every website on the server. An attacker who gains root or elevated access on a shared hosting box can read all customer databases, intercept credentials, plant web shells across tenant directories, and pivot into backup repositories that may contain data from other infrastructure.
Backup plugins are particularly juicy targets because they operate with elevated filesystem permissions by design — they must traverse and read every tenant's data to perform backups. An LPE in a backup agent is effectively an LPE in a component that already has a broad trust footprint.
Who Is Most at Risk
The Detection Challenge
Acronis has not published IOCs, and the advisory is based on what the company describes as a single report from a "potentially affected" customer. This means defenders cannot rely on signature-based detection for post-compromise validation. You must assume that if you were running an affected version, you may need to investigate — not simply patch and move on.
Key things to look for on potentially compromised hosts:
- Unexpected
sudoorsuactivity in/var/log/auth.logor/var/log/securearound the Acronis plugin's execution context. - Processes running as
rootspawned from the Acronis plugin's working directory or binary path. - Unusual file access patterns across tenant home directories (
/home/*) that do not correspond to scheduled backup jobs. - Modified SUID binaries or newly created files in world-writable plugin directories.
- Web shells or unexpected PHP files in cPanel account document roots that were not placed by the account owner.
Shield53 Recommendations
Immediate Actions
- Patch now. Update the Acronis Backup plugin for cPanel/WHM to version 1.9.3 HF3 or later. Update the Acronis Backup extension for Plesk to version 1.8.11 or later. Do not delay for maintenance windows — this is under active exploitation.
- Audit plugin versions across all managed servers. Hosting providers should script a version check across their entire fleet rather than relying on manual per-server verification.
- Review access logs on any host that was running an affected build. Focus on privilege escalation indicators and cross-tenant file access patterns.
- Restrict SSH and shell access on shared hosting servers to the extent possible. The attack requires local access — reducing the number of users with shell access shrinks the attacker's entry points.
Hardening and Ongoing Posture
- Treat third-party control panel plugins as first-class attack surface. They run with elevated privileges and integrate deeply with the OS. Inventory them, track their versions, and subscribe to vendor security feeds.
- Implement file integrity monitoring (FIM) on plugin directories and SUID binaries. LPE exploits often leave forensic traces in filesystem metadata.
- Segment backup infrastructure. Backup agents should not have broader filesystem access than strictly necessary. Where possible, run backup operations in isolated contexts or containers rather than directly on the shared hosting kernel.
- Monitor CISA KEV for potential addition of CVE-2026-87886. If added, federal agencies and many enterprises will face mandatory remediation timelines — get ahead of it.
The "limited, targeted" language in Acronis's advisory is worth parsing carefully. It suggests a specific threat actor with a defined objective, not opportunistic mass scanning. That pattern is consistent with hosting provider targeting for data theft or as an initial access vector for downstream ransomware operations. Hosting providers are attractive intermediaries — compromise one server, and you gain a foothold across hundreds of customer environments simultaneously. Treat this disclosure as a signal to audit your entire plugin ecosystem, not just this one CVE.
