Summary
generated automatically from NVD dataCVE-2026-87886 is a local privilege escalation in Acronis Backup components for hosting control panels on Linux, caused by insecure file permissions (CWE-276). It affects the cPanel & WHM plugin before build 1.9.3.1021, the Plesk extension before build 1.8.11.638, and the DirectAdmin plugin before build 1.2.3.238. A low-privileged local user could gain elevated rights, with high impact on confidentiality, integrity and availability. It is rated 7.8 (HIGH, CVSS v3.0), and CISA's KEV catalog lists it as actively exploited.
NVD description
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-16. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-19
EPSS · FIRST.org
0.23%probability of exploitation in the next 30 days
Higher than 13% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v3.0 Score
Information
- Published
- 17 sept. 2026
- Updated
- 18 sept. 2026
- Status
- Analyzed
- Source
- security@acronis.com
Affected products
Weaknesses (CWE)
References (2)
- https://security-advisory.acronis.com/advisories/SEC-10986Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-276
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.