CVE-2026-87886

Executive Summary

CVE-2026-87886 is a local privilege escalation vulnerability in the Acronis Backup plugins/extensions for cPanel & WHM, Plesk, and DirectAdmin on Linux, caused by insecure (incorrect default) file permissions classified as CWE-276. An authenticated local attacker with low privileges can exploit the misconfigured permissions to escalate to higher privileges, with high impact to confidentiality, integrity, and availability (CVSS 7.8). The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-09-19, indicating confirmed exploitation in the wild and elevated urgency for affected hosting environments.

Technical Analysis

The root cause is CWE-276: Incorrect Default Permissions. Per the NVD description, the Acronis Backup integrations for three Linux hosting control panels (cPanel & WHM, Plesk, and DirectAdmin) install files or directories with permissions that are too permissive. This is a local vulnerability (AV:L), requires low privileges (PR:L), requires no user interaction (UI:N), and has no scope change (S:U) — meaning the attacker already holds a low-privileged account on the host and leverages the weak permissions to gain elevated rights within the same security authority.

Because CWE-276 concerns default permission assignments, the vulnerability class centers on world-writable, group-writable, or overly broad modes applied to sensitive files, scripts, or directories owned or used by a privileged component of the backup integration. When a privileged process (running as root or a control-panel service account) reads from or executes content in a location that a low-privileged local user can write to, that user can substitute or modify content and have it consumed with elevated privileges — the classic "insecure permissions enabling privilege escalation" pattern. The precise file paths, permission bits, and affected binaries are not disclosed in the provided NVD description; no function names, endpoints, or filesystem paths are specified there, and this report does not fabricate them.

Attack surface: any Linux host running one of the three named Acronis Backup integrations at a build below the fixed thresholds. The exposed component is the locally installed plugin/extension, not a remotely reachable network service. The fixed versions are:

• Acronis Backup plugin for cPanel & WHM (Linux): fixed in build 1.9.3.1021
• Acronis Backup extension for Plesk (Linux): fixed in build 1.8.11.638
• Acronis Backup plugin for DirectAdmin (Linux): fixed in build 1.2.3.238

Technical detail note: Beyond the vulnerability class and the affected/fixed build identifiers, insufficient technical detail is available in the supplied description to describe specific code paths. The analysis below therefore operates at the vulnerability-class level as required.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-87886; the attack chain below is inferred from the vulnerability class (CWE-276) and the CVSS characterization. Despite the absence of a public PoC, CISA KEV inclusion indicates real-world exploitation.

1. Reconnaissance / target identification. The attacker requires a foothold on the target Linux host — a low-privileged shell, a compromised hosting account, or a tenant account on a shared cPanel/Plesk/DirectAdmin server. The attacker then enumerates the filesystem for files and directories belonging to the installed Acronis Backup integration and inspects permissions to find entries that are writable by the low-privileged user but are read, executed, or otherwise consumed by a privileged process. (The supplied description confirms insecure file permissions but does not name the specific paths or binaries involved.)

2. Triggering the flaw class. Because CWE-276 arises from incorrect default permissions, the attacker does not need to exploit a memory-safety bug or cause a crash. The "trigger" is the pre-existing permission misconfiguration itself: a privileged component trusts a file, directory, or path that the low-privileged user can modify. The attacker prepares a malicious version of that resource or places content in a location the privileged process will consume.

3. Payload / execution method (vulnerability-class level). The attacker leverages the writable resource so that a privileged process — for example, a root-run service, scheduled task, or control-panel hook of the backup integration — acts on attacker-controlled content. Depending on which resource is misconfigured (per the class, e.g., a writable directory or file in the integration's install/data path), this results in the privileged component executing or importing attacker-supplied logic. The precise mechanism cannot be stated beyond this class-level description because the NVD text does not disclose it.

4. Post-exploitation impact. Per the CVSS vector, successful exploitation yields High confidentiality, High integrity, and High availability impact (C:H/I:H/A:H) with low privileges required and no interaction. In practice this means full compromise of the host: reading sensitive backup data and credentials, modifying system or backup content, disabling or destroying backups, and pivoting from the compromised server into the broader managed environment.

Recommendation: treat the absence of a public exploit as tactical, not strategic. The KEV listing demonstrates that exploitation is occurring.

Impact Assessment

• Scope and blast radius: The affected products are widely deployed on shared/managed Linux hosting platforms. A single compromised low-privileged account on such a host can, via this flaw, reach root-level control of the machine.
• CVSS 7.8 (High) — subscore interpretation:
  • AV:L (Local): exploitation requires local presence on the host, not network reachability.
  • AC:L (Low): no special conditions beyond the misconfigured permissions.
  • PR:L (Low): an ordinary authenticated local user is sufficient.
  • UI:N (None): no victim interaction required.
  • S:U (Unchanged): impact stays within the same authorization scope.
  • C:H / I:H / A:H: high loss of confidentiality, integrity, and availability.
• Business impact: Hosting providers and enterprises running these control-panel integrations face tenant-to-root escalation risks. High availability impact implies risk to backup integrity/restorability — a direct threat to ransomware resilience and disaster-recovery posture. Because backups are a high-value target, this vulnerability is especially dangerous in shared-hosting and MSP environments.
• Known exploitation: CISA KEV lists "Acronis Backup Incorrect Default Permissions Vulnerability" with a required remediation action by 2026-09-19, confirming active exploitation.

Detection Guidance

Sigma Rule

title: Suspicious Modification of Acronis Backup Integration Files (CWE-276 Privilege Escalation)
id: 8f2c1a4e-2026-87886-acronis-lpe
status: experimental
description: Detects writes/chmod operations targeting Acronis Backup plugin/extension paths on Linux control-panel hosts, consistent with exploitation of CVE-2026-87886 (insecure file permissions leading to local privilege escalation).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87886
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Valters IT Threat Intelligence
date: 2026-09-19
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-87886
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - 'acronis'
      - 'Acronis'
  selection_operation:
    - EventType: 'FileCreate'
    - EventType: 'FileModify'
    - EventType: 'FileAttributeChange'
  selection_chmod:
    Image|endswith:
      - '/chmod'
      - '/chown'
    CommandLine|contains:
      - 'acronis'
      - 'Acronis'
  condition: (selection_path and selection_operation) or selection_chmod
falsepositives:
  - Legitimate Acronis Backup updates or administrative maintenance
  - Package manager operations upgrading the plugin/extension
level: high

YARA Rule

rule CVE_2026_87886_Acronis_LPE_Artifacts
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects files referencing Acronis Backup control-panel integrations that may be abused via CWE-276 insecure permissions"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-87886"
        cve         = "CVE-2026-87886"
        date        = "2026-09-19"

    strings:
        $p1 = "Acronis Backup" ascii nocase
        $p2 = "cPanel" ascii nocase
        $p3 = "Plesk" ascii nocase
        $p4 = "DirectAdmin" ascii nocase
        $a1 = "acronis" ascii nocase
        $a2 = "acronisbackup" ascii nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (1 of ($a*) or 2 of ($p*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-87886 Possible Acronis Backup Post-Exploitation Exfil/Beacon"; flow:established,to_server; http.header; content:"Acronis"; http.header; content:"Backup"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-87886; reference:url,www.cisa.gov/known-exploited-vulnerabilities-catalog; metadata:created_at 2026_09_19, updated_at 2026_09_19; sid:202687886; rev:1;)

Elastic Detection

// EQL query (Elastic) — detects local writes/modifications to Acronis Backup integration files on Linux hosts
process where event.type in ("start", "change") and
  process.name in ("chmod", "chown", "cp", "mv", "ln", "dd", "install") and
  wildcard(process.args, "*acronis*")

Splunk SPL Query

index=linux OR index=auditd (TargetFilename="*acronis*" OR TargetFilename="*Acronis*" OR CommandLine="*acronis*")
| where match(EventType,"FileCreate|FileModify|FileAttributeChange") OR match(CommandLine,"chmod|chown")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host TargetFilename
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="acronis,cve-2026-87886,">
  <rule id="2026879" level="12">
    <if_sid>550</if_sid>
    <field name="file">acronis|Acronis</field>
    <description>CVE-2026-87886: Modification of Acronis Backup plugin/extension file detected (possible local privilege escalation via insecure permissions).</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,cve_2026_87886,</group>
  </rule>
  <rule id="2026880" level="12">
    <decoded_as>json</decoded_as>
    <field name="command">acronis</field>
    <description>CVE-2026-87886: Suspicious chmod/chown operation against Acronis Backup paths detected.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,cve_2026_87886,</group>
  </rule>
</group>

Detection caveat: Because the NVD description does not disclose specific file paths, the detections above anchor on the product/vendor identifier ("Acronis") and on permission-change activity. Detection engineers should baselining the exact install paths of each plugin/extension in their environment and tighten these rules accordingly.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix URL, workaround, or CVE package mapping was supplied. The fixed build numbers below are stated in the NVD description and represent the target upgrade state, but no confirmed patch artifact was verified.

1. Immediate mitigations (compensating controls):
   • Audit and manually correct permissions on the Acronis Backup plugin/extension directories and files on cPanel & WHM, Plesk, and DirectAdmin Linux hosts — ensure no low-privileged user has write access to resources consumed by privileged processes (ownership root, restrictive modes).
   • Restrict local shell access and tenant privileges on shared hosting nodes where possible; monitor for new low-privileged accounts.
   • Enable filesystem integrity monitoring (FIM) and the detection rules in the section above to catch unauthorized modification of Acronis integration files.
   • Isolate or temporarily disable the Acronis Backup integration if it cannot be upgraded immediately and the host is high-risk.
2. Patch / upgrade steps:
   • Upgrade the Acronis Backup plugin for cPanel & WHM (Linux) to build 1.9.3.1021 or later.
   • Upgrade the Acronis Backup extension for Plesk (Linux) to build 1.8.11.638 or later.
   • Upgrade the Acronis Backup plugin for DirectAdmin (Linux) to build 1.2.3.238 or later.
   • Coordinate with the hosting control-panel vendor and Acronis for authoritative upgrade packages; verify fixed builds are installed via version check.
3. Long-term hardening:
   • Enforce a secure-permissions baseline for all control-panel integrations during deployment (least-privilege, no world/group-writable sensitive paths).
   • Automate permission-drift detection and remediate deviations.
   • Track CISA KEV remediation deadlines (this CVE: 2026-09-19) and integrate them into patch SLAs.
   • Adopt defense-in-depth for backup infrastructure given its high value as a ransomware target.

References

• NVD — CVE-2026-87886: https://nvd.nist.gov/vuln/detail/CVE-2026-87886
• CISA Known Exploited Vulnerabilities Catalog (Acronis Backup Incorrect Default Permissions Vulnerability; remediate by 2026-09-19): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-276: Incorrect Default Permissions: https://cwe.mitre.org/data/definitions/276.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Acronis Security Advisories (vendor advisory hub — verify fixed builds 1.9.3.1021 / 1.8.11.638 / 1.2.3.238): https://www.acronis.com/en-us/security/

Threat actor / exploit-in-the-wild note: Per the provided intelligence, CISA KEV inclusion confirms real-world exploitation of this vulnerability, though no specific threat actor, campaign, or public exploit code has been attributed in the supplied data. No public PoC, Nuclei template, or exploit code was identified; the attack chain in this report is inferred from the vulnerability class (CWE-276) and must be treated as such.