Acronis Backup Plugin CVE-2026-87886: One Tenant, Root on the Whole cPanel Host

The one control every ransomware playbook tells you to harden is your backups. Immutable copies, offline vaults, tested restores — the whole point is that when everything else is encrypted, the backup is the thing that survives. So it is worth sitting with the shape of CVE-2026-87886: a flaw in the Acronis Backup plugin for cPanel & WHM that lets a low-privileged local user become root. The instrument you installed to survive an attack is the instrument that hands over the box.

CISA added it to the Known Exploited Vulnerabilities catalog on 16 September 2026, citing exploitation in the wild. Acronis itself confirmed the attacks are real but "limited and targeted," and — as is now the norm on day zero — has not published technical details. That combination, a rooted backup agent on the most densely multi-tenant surface in hosting, is why this a 7.8 that behaves like something worse.

What CVE-2026-87886 actually is

The root cause is mundane and, for backup software, almost traditional: incorrect default file permissions (CWE-276). A component the plugin ships and runs with elevated rights is left writable — or reachable — by an unprivileged local account. An attacker who already has a low-privilege foothold on the server modifies or plants a file that the privileged backup process then executes or trusts, and the privilege boundary collapses to root.

The verified facts, from the Acronis advisory SEC-10986 and the KEV listing:

Attribute	Value
CVE	CVE-2026-87886
CVSS 3.1	7.8 (High)
Weakness	CWE-276 — Incorrect Default Permissions
Vector	Local, low privileges required, no user interaction
Affected	Acronis Backup plugin for cPanel & WHM (Linux) < build 1.9.3.1021
	Acronis Backup extension for Plesk (Linux) < build 1.8.11.638
Fixed in	cPanel & WHM: 1.9.3 HF3 (build 1.9.3.1021) · Plesk: 1.8.11.638
Exploited	Yes — limited, targeted attacks against the cPanel & WHM plugin
KEV added	2026-09-16

"Local, low privileges required" is the phrase that gets a CVE deferred by most triage queues, because it reads like the attacker already needs to be inside. On a dedicated server that is a fair objection. On a shared hosting node it is the entire business model — that box is deliberately populated with hundreds of low-privilege tenants who bought exactly the foothold this exploit starts from. One compromised or malicious cPanel account, one weak PHP app on one vhost, and the attacker is standing precisely where CVE-2026-87886 begins. Escalation to root then owns every other tenant on the machine.

Why "attack the backup" is the whole plan, not a footnote

This is not an isolated bug; it is the latest entry in a long line. Backup products run privileged daemons and services by design — they have to read every file to protect it — which makes their local attack surface unusually valuable. The same class recurs across the market: Kaseya Unitrends shipped a world-writable file that let a local user execute code and escalate (CVE-2021-43034); Veeam Backup & Replication carried a local privilege escalation (CVE-2026-21672); CloudBerry Backup let a normal user escalate via a pre/post-backup action (CVE-2019-15720). The privileged-service-plus-loose-permissions pattern is a permanent fixture of the category.

Attackers know why the target is worth the effort, and the numbers are stark. In Sophos's State of Ransomware 2026, 94% of organisations hit by ransomware said the attackers attempted to compromise their backups during the attack, and those attempts succeeded 57% of the time. The payoff is not subtle: when the backups go down with everything else, median recovery costs run roughly eight times higher than for victims whose backups survive intact.

"We have offline, immutable backups, so ransomware isn't an existential risk for us." — a reasonable CISO, describing a control whose management agent runs as root on a machine full of untrusted tenants.

That sentence is true right up until the backup agent itself is the privilege-escalation primitive. The plan attackers run is not "encrypt, then hope the victim has no backups." It is "get a foothold, escalate through whatever privileged service is loosest, neutralise recovery first, then encrypt." CVE-2026-87886 is a ready-made second step for that plan on the single most crowded server class on the internet.

The multi-tenant blast radius

On a shared cPanel/WHM node the escalation does not just compromise one account — it changes who the attacker is on the entire machine:

• Every vhost, every tenant. Root reads every home directory, every wp-config.php, every database credential, every stored API key on the box.
• The backups of all of them. The Acronis agent has, by function, read/write reach into the backup store for every account it protects. Root over the agent is root over everyone's recovery point.
• Provider credentials. cPanel/WHM nodes hold API tokens to the hosting control plane, DNS, and often the reseller hierarchy — the pivot from one box to the estate.
• A trusted position for the next stage. From root, the attacker can tamper backups quietly, wait, and detonate on their schedule — the double-extortion cadence that makes the Sophos cost multiple real.

The uncomfortable part is what happens to your evidence once that root is achieved. A rooted host's local logs, the backup agent's own job history, the cPanel audit trail — all of it is now written by the attacker. Incident responders who reconstruct the intrusion from on-box telemetry are, in the most literal sense, reading a statement the adversary was free to edit.

Remediation

CVE-2026-87886 is exploited and KEV-listed, so under CISA's BOD 26-04 risk-based tiers it belongs in the rapid-remediation bucket, not next month's patch window. Work the report top to bottom.

1. Am I affected?

Check the installed plugin/extension build on every cPanel/WHM and Plesk node:

# cPanel & WHM
cat /usr/local/cpanel/3rdparty/acronis/VERSION 2>/dev/null
rpm -qa | grep -i acronis
# Plesk
plesk bin extension --list | grep -i acronis

You are exposed if the cPanel & WHM plugin is below build 1.9.3.1021 or the Plesk extension is below 1.8.11.638. Exploitation to date has hit the cPanel & WHM plugin specifically — treat those nodes as highest priority.

2. Patch — exact fixed versions.

Update to Acronis Backup plugin for cPanel & WHM 1.9.3 HF3 (build 1.9.3.1021) and Acronis Backup extension for Plesk 1.8.11.638 or later, per advisory SEC-10986. This is the only real fix — the flaw is in shipped file permissions, so nothing short of the corrected build removes it.

3. Can't patch this hour? Compensating controls.

• Tighten permissions on the plugin's directories and service-owned files: no group/other write on anything the privileged agent reads or executes; audit for world-writable files under the Acronis install path (find <acronis_path> -perm -0002 -type f).
• Restrict who can reach the box at low privilege at all: suspend or isolate any tenant account you cannot vouch for while the window is open.
• If feasible, stop the plugin's privileged service until patched — a paused backup is recoverable; a rooted node is not.

4. Hunt for compromise.

Assume the foothold predates the patch. Map to MITRE ATT&CK and hunt off-box wherever possible:

• T1068 / T1222 (Exploitation for Privilege Escalation / File & Directory Permission Modification): look for unprivileged users writing to Acronis service-owned paths, then a same-user process re-executing as root. auditd watches on the install path catch this; a rooted attacker can wipe local audit, so ship these to a remote collector.
• T1490 / T1485 (Inhibit System Recovery / Data Destruction): unexpected backup deletions, retention-policy changes, or job cancellations in the Acronis console — especially clustered just before an encryption event.
• T1078 (Valid Accounts): cross-tenant access, new WHM/root logins from unfamiliar sources, freshly created reseller accounts.
• T1041 (Exfiltration Over C2): sustained outbound volume or connections to never-before-seen ASNs from a node whose normal egress is narrow (updates, license checks, backup targets you defined).

5. Eradicate and verify.

If you find evidence of escalation, patching is not remediation. Root-level compromise of a multi-tenant host means: rebuild the node rather than clean in place; rotate every credential the box could read — tenant DB passwords, API tokens, control-plane and DNS keys, SSH keys; and verify your backups restore to known-good state from an offline copy, on the assumption the online ones were reachable. Confirm clean after the rebuild, not before.

Where Zero Hunt fits: the wire is the only honest witness

Everything above turns on one hard fact: once CVE-2026-87886 gives an attacker root on the backup host, the host can no longer be trusted to tell you what happened to it. The agent's job history, the local logs, the audit trail — all writable by the adversary. This is the exact scenario Zero Hunt's AI Traffic Analysis pillar was built for. The deep-learning model runs on the appliance GPU with four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting) at a 2.7+ Gbit/s baseline, reading the network while the activity is happening — not in tomorrow's SIEM digest that the rooted box helped write. The application-fingerprinting head knows what normal Acronis and cPanel traffic looks like, so an interactive shell, a beacon to a never-seen ASN, a cross-tenant lateral fan-out, or the burst of backup-store deletions before an encryption run all surface the moment they appear on the wire — the one surface a rooted appliance cannot rewrite.

That answers detection. The prior question — is this privilege escalation actually reachable on your build, or is it a 7.8 you can safely defer? — is where the AI Generative Pentest swarm follows: a change-triggered campaign takes a realistic low-privilege foothold and runs the escalation to root against your specific version, with the exploit written per-target by a local LLM (never pulled from a public PoC), backtested in the AI Gym before it touches production, and every finding ECDSA-signed for a chain of custody the rooted host cannot forge. And because backups are a mandated resilience control under NIS2, DORA, and ISO 27001, Zero Hunt's compliance layer maps that single finding across all 32 frameworks at once — so "prove your recovery control is not itself the attack path" becomes signed evidence rather than an assertion.

The lesson of CVE-2026-87886 is older than the CVE: a control you cannot observe independently is a control you are trusting on faith. For more on the recovery-first attacker model, see our analysis of exfiltration-only ransomware and shared-hosting root escalation.