CVE-2026-87886: Acronis Backup Plugin Incorrect Default Permissions (KEV)

CVE-2026-87886 is an incorrect-default-permissions bug in the Acronis Backup integrations for three Linux hosting control panels (cPanel & WHM, Plesk, DirectAdmin) that lets an authenticated local user with low privileges escalate to full control of the backup plugin, and CISA added it to the Known Exploited Vulnerabilities catalog days after disclosure with only a 3-day remediation window.

CVE-2026-87886 affects the Acronis Backup plugins and extensions that hosting providers install into three Linux web-hosting control panels: cPanel & WHM, Plesk, and DirectAdmin. NVD's description states this is a "Local privilege escalation due to insecure file permissions" affecting "Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238" (NVD).

Acronis's own CNA submission, which NVD stores as a Secondary (not NVD-confirmed) metric, scores this CVSS v3.0 7.8 (high), vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — a local attack vector requiring only low privileges and no user interaction, with full confidentiality, integrity and availability impact once triggered. CWE-276 (Incorrect Default Permissions) is the assigned weakness (NVD).

This page does not cite Acronis's own advisory page (security-advisory.acronis.com/advisories/SEC-10986, referenced by both NVD and CISA KEV) for vendor-specific detail, because that page is a client-side JavaScript single-page application: an automated, headless fetch of it returns only an empty <div id="app"> shell with no vulnerability text. No claim beyond what NVD and CISA independently publish is made on the strength of that page (Acronis Advisory Database SEC-10986).

CISA added CVE-2026-87886 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16, with a required-action due date of 2026-09-19 — a 3-day window — and records knownRansomwareCampaignUse as "Unknown" (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.0023 (14.117th percentile) — low, consistent with a bug that already requires an authenticated local account on the hosting panel before it can be used (FIRST EPSS).

Because the flaw only needs a low-privileged local account to escalate to full control of the backup plugin — and, on shared hosting, tenants already have exactly that kind of local account — any cPanel & WHM, Plesk, or DirectAdmin server running an Acronis Backup integration older than the fixed builds above should be updated immediately.

• Insecure default file permissions (CWE-276) allow local privilege escalation in the Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021, the extension for Plesk before build 1.8.11.638, and the plugin for DirectAdmin before build 1.2.3.238. — NVD
• CVSS v3.0 base score is 7.8 (high), vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, submitted directly by Acronis's own CNA and stored by NVD as a Secondary (not NVD-confirmed) metric. — NVD
• Acronis's own advisory page is a client-side JavaScript single-page app; an automated fetch returns only an empty app shell with no readable vulnerability content, so no vendor-specific claim is sourced to it. — Acronis Advisory Database SEC-10986
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-16, required action due 2026-09-19; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
• EPSS score is 0.0023 (14.117th percentile) as of 2026-10-27. — FIRST EPSS