CVE-2026-87886 (GCVE-0-2026-87886)
Vulnerability from cvelistv5 – Published: 2026-09-17 22:57 – Updated: 2026-09-17 23:09Summary
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Severity
7.8 (High)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security-advisory.acronis.com/advisories/… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Acronis | Acronis Backup plugin for cPanel & WHM |
Affected:
unspecified , < 1.9.3.1021
(semver)
|
guessed | |
| Acronis | Acronis Backup extension for Plesk |
Affected:
unspecified , < 1.8.11.638
(semver)
|
guessed | |
| Acronis | Acronis Backup plugin for DirectAdmin |
Affected:
unspecified , < 1.2.3.238
(semver)
|
guessed |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 320a50a7-980d-4162-b090-c53849c01837
Exploited: Yes
Timestamps
First Seen: 2026-09-16
Asserted: 2026-09-16
Scope
Notes: Acronis Backup Incorrect Default Permissions Vulnerability | Affected: Acronis / Backup | Description: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-276 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Backup |
| Due Date | 2026-09-19 |
| Date Added | 2026-09-16 |
| Vendorproject | Acronis |
| Vulnerabilityname | Acronis Backup Incorrect Default Permissions Vulnerability |
| Knownransomwarecampaignuse | Unknown |
References
Created: 2026-09-16 20:00 UTC
| Updated: 2026-09-16 20:00 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 5c238c9c-ce9f-448b-b2cf-c1ad073c5b59
Exploited: Yes
Timestamps
First Seen: 2026-09-15
Asserted: 2026-09-15
Scope
Notes: Acronis Backup plugin Local privilege escalation due to insecure file permissions | Affected: Acronis / Acronis Backup | CVSS: 7.8 (HIGH) | Used in malware: unknown | Listed 21 hours ahead of CISA KEV | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 70%
Source: previdian
Details
| Feed | Previdian (previdian.com) |
|---|---|
| Title | Acronis Backup plugin Local privilege escalation due to insecure file permissions |
| Cve Id | CVE-2026-87886 |
| Vendor | Acronis |
| Ghsa Id | None |
| Product | Acronis Backup |
| Added Date | 2026-09-15T21:57:00.000Z |
| Cvss Score | 7.8 |
| Epss Score | None |
| Previous Ids | |
| Cvss Severity | HIGH |
| Virtual Patch | False |
| Cvss Estimated | False |
| Epss Percentile | None |
| Used In Malware | unknown |
| Vulnerability Id | CVE-2026-87886 |
| Ahead Of Cisa Kev |
|
| Not Yet In Cisa Kev | False |
References
Created: 2026-09-16 22:00 UTC
| Updated: 2026-09-16 22:00 UTC
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Acronis Backup plugin for cPanel \u0026 WHM",
"vendor": "Acronis",
"versions": [
{
"lessThan": "1.9.3.1021",
"status": "affected",
"version": "unspecified",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Acronis Backup extension for Plesk",
"vendor": "Acronis",
"versions": [
{
"lessThan": "1.8.11.638",
"status": "affected",
"version": "unspecified",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Acronis Backup plugin for DirectAdmin",
"vendor": "Acronis",
"versions": [
{
"lessThan": "1.2.3.238",
"status": "affected",
"version": "unspecified",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel \u0026 WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T23:09:27.166Z",
"orgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175",
"shortName": "Acronis"
},
"references": [
{
"name": "SEC-10986",
"tags": [
"vendor-advisory"
],
"url": "https://security-advisory.acronis.com/advisories/SEC-10986"
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175",
"assignerShortName": "Acronis",
"cveId": "CVE-2026-87886",
"datePublished": "2026-09-17T22:57:18.089Z",
"dateReserved": "2026-09-09T14:04:36.755Z",
"dateUpdated": "2026-09-17T23:09:27.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-87886\",\"sourceIdentifier\":\"security@acronis.com\",\"published\":\"2026-09-17T23:18:53.763\",\"lastModified\":\"2026-09-18T00:17:48.480\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel \u0026 WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.\"}],\"affected\":[{\"source\":\"security@acronis.com\",\"affectedData\":[{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for cPanel \u0026 WHM\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"1.9.3.1021\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup extension for Plesk\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"1.8.11.638\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for DirectAdmin\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"lessThan\":\"1.2.3.238\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@acronis.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2026-09-16\",\"cisaActionDue\":\"2026-09-19\",\"cisaRequiredAction\":\"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.\",\"cisaVulnerabilityName\":\"Acronis Backup Incorrect Default Permissions Vulnerability\",\"weaknesses\":[{\"source\":\"security@acronis.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"references\":[{\"url\":\"https://security-advisory.acronis.com/advisories/SEC-10986\",\"source\":\"security@acronis.com\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…