Acronis Warns of CVE-2026-87886 Exploitation in Backup Plugins

Acronis has issued an urgent advisory regarding CVE-2026-87886, a high-severity (CVSS 7.8) local privilege escalation vulnerability affecting its backup integrations for Linux-based hosting platforms. The company has confirmed that this flaw is currently being exploited in the wild in limited, targeted attacks. The vulnerability resides in the backup plugins for cPanel, WebHost Manager (WHM), and Plesk, which are widely used by web hosting providers to manage server infrastructure.

Technically, the flaw allows a low-privileged attacker to elevate their permissions on a vulnerable Linux server without requiring user interaction. This could lead to unauthorized access, modification of sensitive data, or system disruption. While technical details remain limited to prevent widespread exploitation, Acronis has released patches to address the issue across affected product lines.

This vulnerability is particularly critical for the web hosting sector and managed service providers (MSPs) using Acronis integrations. Given the confirmed exploitation and the sensitive nature of backup infrastructure, immediate patching is required to mitigate the risk of full server compromise.