Acronis cPanel/Plesk backup plugin flaw exploited for Linux privilege escalation

Affected Systems

Acronis Backup plugin for cPanel & WHM (builds < 1.9.3.1021) and Acronis Backup extension for Plesk (builds < 1.8.11.638). Affects Linux servers running these backup integrations in web hosting environments.

Exploitation Status

Active exploitation confirmed in limited, targeted attacks against cPanel & WHM deployments. Acronis detected exploitation based on at least one customer report. No public PoC available; technical details withheld to allow patching time.

Business Impact

CVE-2026-87886 (CVSS 7.8) allows low-privileged local attackers to escalate privileges on vulnerable Linux servers without user interaction. Successful exploitation enables access to sensitive hosting data, customer databases, mailboxes, and potential system disruption. Primary risk to web hosting providers and managed service providers using Acronis backup integrations. No specific IoCs published; detection of compromise may be difficult.

Urgency

🔴 Immediate

Recommended Actions

• Immediately update Acronis Backup plugin for cPanel & WHM to version 1.9.3 HF3 (build 1.9.3.1021 or later)
• Immediately update Acronis Backup extension for Plesk to version 1.8.11 (build 1.8.11.638 or later)
• Review Linux system logs and user privilege changes on servers running affected Acronis plugins for anomalous activity since initial disclosure
• Audit local user accounts and sudo/root access on cPanel/WHM and Plesk servers for unauthorized privilege escalation
• If immediate patching is not possible, consider temporarily disabling the Acronis backup plugin and using alternative backup methods until updates are applied