Skip to content
Acronis Patches Critical cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

Acronis Patches Critical cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks

First seen 16 Sep 2026, 10:56 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 17, 2026 at 10:56 UTC
  • •CVE-2026-87886 allows local privilege escalation in Acronis Backup plugins.
  • •Exploitation has been confirmed in limited, targeted attacks against affected systems.
  • •Users must update to the latest plugin versions to protect against this vulnerability.

Acronis has released urgent patches for a high-severity vulnerability (CVE-2026-87886) in its Backup plugin for cPanel & WHM and Plesk, which has been actively exploited in targeted attacks. The flaw, stemming from insecure file permissions, allows low-privileged attackers to escalate their privileges on affected Linux servers. All versions of the Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 and the Backup extension for Plesk before build 1.8.11.638 are vulnerable. Acronis detected exploitation in the wild but has not disclosed specific details about the attacks or the attackers' objectives. Users are urged to apply the patches immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 44d ago How this analysis works

Timeline

2026-09-14
Vulnerability disclosed
Acronis published an advisory about CVE-2026-87886, a high-severity flaw in its Backup plugin.
Bleepingcomputer
2026-09-14
CVE-2026-76461 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-15
Active exploitation confirmed
Acronis reported that the vulnerability is being exploited in the wild in targeted attacks against its Backup plugin.
Bleepingcomputer
2026-09-16
Patches released
Acronis released patches for the Backup plugin for cPanel & WHM and Plesk to address CVE-2026-87886.
Securityweek

More articles in this cluster (6)

Following this threat?

Track Cisco and CVE-2026-76461 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4