Acronis Backup Vulnerability (CVE-2026-87886) Allows Privilege Escalation

Hosting environments running the Acronis Backup plugin for cPanel & WHM or Plesk face a local privilege escalation risk designated as CVE-2026-87886. The issue stems from overly permissive default file or directory permissions assigned during the installation and operation of the backup agent extensions. If an attacker manages to gain a low-privileged foothold on a shared hosting server—such as through a compromised web application or cPanel user account—they can leverage this Acronis Backup vulnerability to escalate privileges directly to root.

Exploiting Flawed Control Panel Extensions

In multi-tenant web hosting environments like cPanel & WHM and Plesk, security boundaries rely heavily on strict privilege separation between individual customer accounts and system management daemons. Extensions and plugins that handle system-level operations, such as bare-metal or file-level backups, must run with root-level capabilities to read arbitrary system files and construct backup archives.

When an integration of this scale installs binaries, scripts, socket files, or configuration templates with insecure default permissions (such as world-writable modes like 0777 or insecure group ownerships), any local shell user can modify those assets. When the higher-privileged Acronis background service or cron job subsequently executes the modified script or reads an altered configuration file, it executes attacker-controlled code within a root context.

Realistic Attack Path

An end-to-end compromise leveraging CVE-2026-87886 typically follows a predictable sequence in shared hosting environments:

1. Initial Access: The adversary gains entry to a non-privileged system account on the hosting node, frequently by exploiting a vulnerable CMS plugin (e.g., WordPress or Joomla) or acquiring stolen cPanel/Plesk user credentials.
2. Local Reconnaissance: The attacker enumerates file system permissions across common third-party plugin paths, identifying world-writable files, scripts, or IPC mechanisms associated with the Acronis Backup agent.
3. Privilege Escalation: By modifying an executable hook or injecting commands into a writable script or configuration path managed by the Acronis extension, the attacker waits for or triggers the scheduled backup job. The service executes the payload as root, granting full system access.
4. Impact: With root access established, multi-tenant isolation breaks down completely. The attacker can access database secrets for every hosted customer, modify web root files server-wide, or deploy persistent backdoors across the underlying host.

Specific Remediation Guidance

To mitigate CVE-2026-87886, server administrators and web hosting providers must update their Acronis Backup plugin for cPanel & WHM and Acronis Backup extension for Plesk immediately using the latest packages released by Acronis.

• cPanel & WHM: Update the acronis-backup-cpanel package via your server’s package manager (yum update / dnf update or apt-get update) or through the WHM plugin manager interface. Ensure the underlying Acronis Cyber Protect / Backup Agent daemon is updated to the latest build.
• Plesk: Navigate to the Plesk Extension Catalog and update the Acronis Backup extension to the latest version, or execute plesk bin extension --update acronis-backup via SSH.
• Permission Audit: Run an immediate audit on the Acronis plugin installation directories (such as /usr/local/cpanel/3rdparty/ or /usr/local/psa/admin/htdocs/modules/acronis-backup/) to verify that no files or scripts retain world-writable (o+w) permissions. Ensure file ownership belongs exclusively to root.