Privilege Escalation via Vulnerable Acronis Backup Plugin (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•6

This rule detects potentially malicious activity involving Linux backup software (Acronis) or attempts to modify file permissions (chmod setuid) to elevate privileges. It triggers when backup-related processes are executed by root or when commands indicative of privilege escalation or tampering occur in conjunction with backup-related paths or binaries.