CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability
Published Sep 16, 2026
·Updated
Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
Affected Software
1 affected component
Acronis Backup
Event History
Sep 16, 2026
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionAffected Software
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Deployments using the Acronis Backup plugin for cPanel & WHM or the Acronis Backup extension for Plesk should be prioritized.
2
Is exploitation known to be occurring?
Yes. The vulnerability is flagged as exploited and was listed in the KEV catalog on 2026-09-16.
3
Are default permission settings relevant to exposure?
Yes. The issue is described as incorrect default permissions, indicating that the default permission configuration is central to the privilege-escalation risk.