CVE-2026-87886

This vulnerability is a “permissions” problem: part of the Acronis backup add-on can be made accessible in a way that lets a low-level local user take over a Linux server. Think of it like leaving a back door key in the lockbox, where someone with limited access could use it to open (and control) the whole building. Since it’s been used in real attacks (at least against the cPanel & WHM plugin), it’s important to update.

This matters if you run Linux servers with the Acronis Backup plugin for cPanel & WHM, the Acronis Backup extension for Plesk, or the Acronis Backup plugin for DirectAdmin and you are on builds older than the fixed versions listed. The weakness requires local low-level access on the server, meaning it’s typically relevant when an attacker already has some foothold (for example, a compromised user account).

Reachability gate: it becomes a risk when a local low-privileged user can access a Linux server running an affected Acronis backup add-on build (before the fixed versions).

This is RED because it is confirmed in CISA KEV and exploitation has been reported in the wild in limited, targeted attacks against the Acronis Backup plugin for cPanel & WHM. The CISA remediation due date is 2026-09-19, so you should treat this as an urgent patching project. Even though it requires local low-level access, attackers commonly reach that stage after an initial compromise, making timely upgrades critical.