CVE-2026-87886 Acronis Backup Plugin LPE to Root

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•5

Detects local privilege escalation attempts targeting Acronis backup plugins for cPanel, WHM, and Plesk. The rule monitors for instances where backup-related processes or binaries located within control panel paths are executed with root privileges when the parent process was not originated by root, a behavior indicative of exploiting insecure file permissions.