Root Process Spawned from Acronis cPanel/WHM Backup Plugin (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects the execution of Acronis management or recovery tools (associated with cPanel, WHM, or Plesk environments) by a non-root user that results in a process running with root privileges. This pattern is indicative of potential privilege escalation by exploiting vulnerabilities in service-level utilities.