Acronis Backup Plugin LPE (CVE-2026-87886) Root Escalation

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•3

Detects processes associated with Acronis backup software executed by a user other than 'root', while the effective user context of the process is 'root'. This behavior often indicates an attempt to exploit setuid binaries or misconfigured permissions to execute commands with elevated privileges.