CVE-2026-87886 Acronis Backup Plugin LPE Exploitation on cPanel/WHM/Plesk

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•4

Detects the execution of Acronis backup-related processes by a non-root user while the process is running with root-level privileges (UID 0). This pattern indicates potential privilege escalation or abuse of existing backup utilities to run with elevated permissions in a context where they should not be.