Root Shell Spawned by Acronis Backup Plugin Process (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•5

Detects the execution of a shell process (sh, bash, dash, zsh) spawned as a child of Acronis backup agent or plugin processes by the root user. This behavior is indicative of potential exploitation of local privilege escalation vulnerabilities, such as CVE-2026-87886, within Acronis backup plugins for cPanel, WHM, and Plesk.