Vulnerable Acronis Backup Plugin Exposure to CVE-2026-87886

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•0

This rule detects file creation, modification, or renaming activity involving Acronis plugins integrated with web hosting control panels such as cPanel, WHM, or Plesk, where the plugin version is identified as vulnerable. It specifically monitors for versions earlier than 1.9.3 (excluding specifically patched 1.9.3 HF3 versions) that are prone to exploitation.