Root-level process spawned via Acronis backup plugin (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

Detects a suspicious scenario where a non-root process associated with Acronis backup plugins (typically used on cPanel, WHM, or Plesk servers) spawns a child process that executes with root privileges. This behavior is indicative of potential privilege escalation exploiting CVE-2026-87886.