CVE-2026-87886 is a local privilege-escalation flaw caused by insecure file permissions in Acronis Backup integrations for Linux hosting panels. The affected integrations are the Acronis Backup plugin for cPanel & WHM, the Acronis Backup extension for Plesk, and the Acronis Backup plugin for DirectAdmin. A server is affected when its installed integration build is below the fixed threshold listed in the table below. The fix is to update that integration through Acronis or the panel vendor’s supported procedure. Acronis has also reported limited, targeted exploitation against cPanel & WHM deployments.
Check your installed build against the fixed threshold
Each panel has its own integration and its own version line, so check the build on every Linux server separately. Any build below the threshold in the table is listed as affected.
As an Amazon Associate I earn from qualifying purchases.
| Integration | Affected Linux builds | Fixed build | Where the fixed build is stated |
|---|---|---|---|
| Acronis Backup plugin for cPanel & WHM | Below 1.9.3.1021 | 1.9.3 HF3 (1.9.3.1021) or later | CERT Vanuatu advisory; CVE record threshold |
| Acronis Backup extension for Plesk | Below 1.8.11.638 | 1.8.11.638 or later | CERT Vanuatu advisory; CVE record threshold |
| Acronis Backup plugin for DirectAdmin | Below 1.2.3.238 | 1.2.3.238 or later | CVE record threshold only; vendor update steps not stated |
The CVE record, published by Acronis as a CVE Numbering Authority and last updated 2026-09-18, limits the affected products to Linux integrations and gives all three thresholds. CERT Vanuatu’s advisory independently names the cPanel & WHM and Plesk builds as patched versions.
What the flaw allows
The CVE record classifies the issue as CWE-276, the weakness class for incorrect default permissions. It carries a CVSS 3.0 base score of 7.8 (High) with the vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Read component by component:
#1 Best Overall
- PCIe 4.0 Performance: Delivers up to 7,100 MB/s read and 6,000 MB/s write speeds for quicker game load times, bootups, and smooth multitasking
- Spacious 2TB SSD: Provides space for AAA games, apps, and media with standard Gen4 NVMe performance for casual gamers and home users
- Broad Compatibility: Works seamlessly with laptops, desktops, and select gaming consoles including ROG Ally X, Lenovo Legion Go, and AYANEO Kun. Also backward compatible with PCIe Gen3 systems for flexible upgrades
- Better Productivity: Up to 2x faster than previous Gen3 generation. Improve performance for real world tasks like booting Windows, starting applications like Adobe Photoshop and Illustrator, and working in applications like Microsoft Excel and PowerPoint
- Trusted Micron Quality: Built with advanced G8 NAND and thermal control for reliable Gen4 performance trusted by gamers and home users
- AV:L requires local access. The flaw is not described as remotely exploitable by itself.
- AC:L means no special conditions are needed to exploit it.
- PR:L means the attacker needs a low-privileged account on the system.
- UI:N means no action from another user is required.
- C:H, I:H, A:H describe high impact to confidentiality, integrity, and availability if exploitation succeeds.
CERT Vanuatu describes the practical outcome: an attacker with a low-privileged authenticated account may escalate privileges, perform unauthorized actions, or run arbitrary code, affecting the confidentiality and integrity of the hosting environment.
Exploitation status
SecurityWeek quotes Acronis as saying: “Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments.” That is the only exploitation reported in the sources reviewed for this article, and it concerns cPanel & WHM. It does not establish attacks against Plesk or DirectAdmin deployments, and “limited, targeted” should not be read as widespread activity.
Rank #2
- Reliable everyday computing
- Western Digital quality and reliability
- Free Acronis True Image WD Edition cloning software
- Capacities up to 12TB
- 2-year limited warranty
The CVE record also includes CISA enrichment data that marks exploitation as active and records the flaw’s addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16. Confirm the current listing directly in CISA’s KEV catalog before relying on that status in a report or compliance document.
How to fix it
- Inventory every Linux server running cPanel & WHM, Plesk, or DirectAdmin. For each one, record the installed Acronis Backup integration build from the panel’s plugin or extension listing, or from the host’s package records.
- Compare each recorded build with the threshold in the table. Any build below the threshold is affected.
- On cPanel & WHM hosts, update the Acronis Backup plugin to 1.9.3 HF3 (1.9.3.1021) or later.
- On Plesk hosts, update the Acronis Backup extension to 1.8.11.638 or later.
- On DirectAdmin hosts, obtain the corrected 1.2.3.238 or later build and its installation procedure from Acronis’s supported channel. The sources reviewed do not give DirectAdmin package commands, so do not follow instructions from unofficial packages or third-party copies.
- Re-check the installed build on each server after updating, and confirm it meets or exceeds the threshold.
Who is at risk on shared hosting
Exposure requires two conditions on the same server: an affected Acronis build, and a local account with low privileges. On shared hosting, tenant accounts are the most obvious example of such local access, because the flaw is a privilege escalation rather than a remote entry point. Hosting type alone does not decide exposure. A provider running an updated integration is not affected by this flaw, and a provider running an older build is affected whether or not its tenants are hostile.
Rank #3
- Transfer speeds of up to 1,100MB/s read and 1,000MB/s write
- Compatible with USB Type-C and Type-A enabled PC and Mac computers, as well as USB Type-C and Type-A enabled tablets, via the included cables
- Ideal for gamers looking to maximize external storage while utilizing the latest Gen 2 technology
- Increased performance for speedy transfer and storage of documents, music, photos, and videos
- Ultra portable for life-on-the go, take your files with you wherever you go in the sleek designed aluminum housing
While patching, reduce the damage an attacker could do from a low-privileged account:
- Apply least privilege to local accounts, as CERT Vanuatu recommends. Remove shell or local login access that tenants or services do not need.
- Prioritize hosts where untrusted or third-party accounts have local access and an affected build is installed.
- Treat least privilege as defense in depth. Updating to the fixed build is the version-based remediation.
What the sources do not establish
- Prevalence: no count of affected servers, providers, or tenants is stated in the sources reviewed.
- Exploitation scope: no exploitation is reported against Plesk or DirectAdmin integrations.
- Non-Linux integrations: the CVE record scopes the affected products to Linux integrations, so do not extend the listed thresholds to other operating systems.
Where these gaps matter for your environment, the safe assumption is to treat any unpatched affected build on a multi-account host as a priority for update.
Quick Recap
Best Value
- Reliable everyday computing
- Western Digital quality and reliability
- Free Acronis True Image WD Edition cloning software
- Capacities up to 12TB
Rank #4
- PCIe 4.0 Performance: Delivers up to 7,100 MB/s read and 6,000 MB/s write speeds for quicker game load times, bootups, and smooth multitasking
- Spacious 1TB SSD: Provides space for AAA games, apps, and media with standard Gen4 NVMe performance for casual gamers and home users
- Broad Compatibility: Works seamlessly with laptops, desktops, and select gaming consoles including ROG Ally X, Lenovo Legion Go, and AYANEO Kun. Also backward compatible with PCIe Gen3 systems for flexible upgrades
- Better Productivity: Up to 2x faster than previous Gen3 generation. Improve performance for real world tasks like booting Windows, starting applications like Adobe Photoshop and Illustrator, and working in applications like Microsoft Excel and PowerPoint
- Trusted Micron Quality: Built with advanced G8 NAND and thermal control for reliable Gen4 performance trusted by gamers and home users
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
