CVE-2026-87886 Acronis Backup Plugin Privilege Escalation

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•5

Detects potential exploitation of CVE-2026-87886 in the Acronis Backup plugin for cPanel & WHM, where an adversary uses insecure file permissions to elevate privileges. The rule monitors for execution of file permission or ownership changing utilities (chmod, chown) targeting files associated with backup plugins.