CVE-2026-87886 Acronis Backup Plugin LPE via Insecure Permissions
This rule detects potential privilege escalation to root originating from Acronis backup plugin processes on hosting platforms like cPanel, WHM, and Plesk. It flags cases where a non-root Acronis process spawns a child process with root effective UID or when the process UID itself changes to zero, potentially exploiting vulnerabilities such as CVE-2026-87886. The rule also correlates this behavior with suspicious file permission changes (chmod/chown) on Acronis plugin directories.
Splunk (SPL)
