Acronis cPanel Backup plugin privilege escalation exploited in wild

Affected Systems

Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021 and Acronis Backup extension for Plesk (Linux) before build 1.8.11.638. Affects Linux-based web hosting control panel deployments.

Exploitation Status

Active exploitation confirmed in limited, targeted attacks. No public PoC available. Attackers are leveraging insecure file permissions to escalate from low-privileged local access to higher privileges.

Business Impact

Hosting providers and organizations using Acronis backup plugins on cPanel/WHM or Plesk face immediate risk. Attackers with low-level access (e.g., compromised hosting accounts) can escalate to root or administrative privileges, enabling arbitrary code execution, data theft, and lateral movement across multi-tenant hosting environments. Timeline and scope of exploitation unknown.

Urgency

🔴 Immediate

Recommended Actions

• Immediately update Acronis Backup plugin for cPanel & WHM to version 1.9.3 HF3 (build 1.9.3.1021 or later)
• Update Acronis Backup extension for Plesk to build 1.8.11.638 or later
• Audit Linux systems running affected plugins for signs of unauthorized privilege escalation or suspicious file permission changes in /opt/acronis or related directories
• Review recent user activity logs and process execution logs (auditd, syslog) on cPanel/WHM and Plesk servers for anomalous behavior by low-privileged accounts
• Restrict local access to hosting servers and enforce least-privilege principles for all user accounts and hosting clients