Weak permissions/chmod on Acronis cPanel & WHM Backup Plugin (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects unauthorized modification of file permissions on Acronis-related files or directories, or modification of Acronis-related files by non-authorized users. This rule targets attempts to weaken file security (e.g., setting permissions to 777 or 666) or unauthorized tampering with Acronis components, which may be part of an attempt to gain persistence, escalate privileges, or evade detection.