CVE-2026-87886 Acronis Backup Plugin LPE via Insecure Permissions

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects the use of administrative utilities like chmod, chown, and setfacl to modify file permissions on paths or commands related to Acronis, cPanel, WHM, or Plesk. This activity could indicate an attempt to manipulate system or application binaries to facilitate privilege escalation or persistence.