Read the docs
TI-2026-59964 Aliases CVE-2026-87886GHSA-hrq3-qgq7-jm9x

Incorrect default permissions in Acronis Backup plugin for cPanel & WHM

Priority CRITICAL 93Exploited in the wildCWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Why it matters now

Exploitation Active In CISA KEV since 2026-09-16CISA due date 2026-09-19
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed Acronis Backup plugin for cPanel & WHM (Acronis): 1.9.3.1021Acronis Backup extension for Plesk (Acronis): 1.8.11.638+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcronisAcronis Backup plugin for cPanel & WHMbefore 1.9.3.10211.9.3.1021Patch availableCNA
AcronisAcronis Backup extension for Pleskbefore 1.8.11.6381.8.11.638Patch availableCNA
AcronisAcronis Backup plugin for DirectAdminbefore 1.2.3.2381.2.3.238Patch availableCNA
  • Acronis Backup plugin for cPanel & WHM VendorAcronis Affected before 1.9.3.1021 Fixed in 1.9.3.1021 Patch available CNA
  • Acronis Backup extension for Plesk VendorAcronis Affected before 1.8.11.638 Fixed in 1.8.11.638 Patch available CNA
  • Acronis Backup plugin for DirectAdmin VendorAcronis Affected before 1.2.3.238 Fixed in 1.2.3.238 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*before 1.2.3VulnerableAcronis
cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*before 1.8.11VulnerableAcronis
cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*before 1.9.3VulnerableAcronis
cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*1.9.3VulnerableAcronis
cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*1.9.3 hotfix1VulnerableAcronis
cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*1.9.3 hotfix2VulnerableAcronis
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:* Versions before 1.2.3 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:* Versions before 1.8.11 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:* Versions before 1.9.3 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:* Versions 1.9.3 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:* Versions 1.9.3 hotfix1 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:* Versions 1.9.3 hotfix2 Vulnerable ·Acronis
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

  • Fix · CNA Acronis Backup plugin for cPanel & WHM (Acronis) Fixed in 1.9.3.1021
  • Fix · CNA Acronis Backup extension for Plesk (Acronis) Fixed in 1.8.11.638
  • Fix · CNA Acronis Backup plugin for DirectAdmin (Acronis) Fixed in 1.2.3.238

Timeline

  1. 2026-09-16 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-87886
  3. 2026-10-03 Alias added: GHSA-hrq3-qgq7-jm9x

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences