Acronis Backup Plugin Privilege Escalation (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects instances where a non-root user executes commands containing 'acronis' alongside web hosting management keywords (cpanel, whm, plesk) while the target process user is 'root'. This behavior suggests an attempt to abuse backup software or administrative management tools to escalate privileges or perform unauthorized administrative actions.