Root Shell Spawned by Acronis Backup Plugin (CVE-2026-87886)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•6

Detects instances where the Acronis backup agent or associated plugin processes spawn a shell (e.g., sh, bash, zsh, perl) under the root user context. This behavior is highly irregular and may indicate a compromised backup utility, the use of backup agent processes to execute arbitrary commands, or unauthorized privilege escalation.