CVE-2026-87886 is an insecure file permissions vulnerability affecting the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. The flaw allows local privilege escalation due to improper file permissions. Exploitation has been observed in the wild against the cPanel plugin but not the Plesk extension. Acronis identified all Linux versions of the Backup plugin for cPanel & WHM before build 1.9.3.1021 and the Backup extension for Plesk before build 1.8.11.638 as affected. The vendor has issued urgent patches to remediate the vulnerability and recommends immediate updates. No detailed technical information about the vulnerability has been publicly shared.

Successful exploitation of this vulnerability can lead to local privilege escalation, allowing attackers with local access to gain elevated privileges on the affected system. This increases the risk of unauthorized system modifications and potential further compromise. Exploitation has been detected in limited, targeted attacks against the Acronis Backup plugin for cPanel & WHM.

Acronis has released official patches that fix this vulnerability in the Backup plugin for cPanel & WHM (fixed in build 1.9.3.1021 and later) and the Backup extension for Plesk (fixed in build 1.8.11.638 and later). Users should immediately update their deployments to these fixed versions or later to mitigate the risk. No additional mitigation steps are specified by the vendor.