Exploitation of Acronis Backup Plugin LPE Vulnerability

Acronis has disclosed a high-severity local privilege escalation (LPE) vulnerability, tracked as CVE-2026-87886, affecting its backup plugins for cPanel, WebHost Manager (WHM), and Plesk. The vulnerability stems from insecure file permissions on Linux servers, allowing low-privileged attackers to gain elevated permissions, potentially accessing or modifying sensitive data and disrupting system operations without user interaction.

Critically, Acronis and security researchers have confirmed that this flaw has been exploited in the wild in limited, targeted attacks. While specific indicators of compromise (IOCs) have not been released to allow administrators time to patch, the vulnerability is confirmed to affect web hosting environments where these management interfaces are common. Organizations using these Acronis integrations should prioritize immediate updates to mitigate the risk of host takeover.