Your Backup Agent Can Root Your cPanel Box — And Someone Already Did (Acronis CVE-2026-87886)

The short version//

The worst insider to get root is the one you invited in. CVE-2026-87886 is a local privilege escalation in Acronis's backup integrations for cPanel & WHM and Plesk: insecure file permissions (CWE-276) let any low-privilege local user escalate to root, no user interaction required. Acronis scores it CVSS 3.0 base 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the advisory carries the line that makes it a tonight story:

"Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments."

That's Acronis's own wording; keep the "limited, targeted" attached to it. Per BleepingComputer, Acronis told them that assessment rests on a single report from a "potentially affected" customer. So: confirmed in-the-wild, but not mass exploitation. CISA added it to KEV on 2026-09-16 with a federal due date of Saturday, 2026-09-19 and a forensic-triage flag under BOD 26-04.

Why a backup plugin is the worst possible root path//

Think about what this component does: it's installed on your hosting box to talk to Acronis's cloud, and it needs to read everything you want backed up: websites, databases, mailboxes, files. A trusted-insider with broad read access is a normal part of the design. The bug means that trust was over-granted: a file or directory the plugin writes has permissions loose enough that an unprivileged local account can work its way to root through it.

Or in plain terms: you hired a moving company and gave them keys to every room because they have to pack everything. Fine — until you discover one of the crew also kept a copy of the keys, and the lock on your safe was held open by their box.

The blast radius is squarely self-hosted territory. cPanel & WHM and Plesk are what small hosting providers, MSPs, and homelab-grade VPS fleets run. Those boxes live exactly where one low-privilege local account exists in plenty: a compromised web app running as nobody or a domain user, an SSH account you forgot about, a service token. Any foothold on the box becomes root.

The fix (verified against SEC-10986 and Acronis's update records)//

Product	Affected	Fixed in
Acronis Backup plugin for cPanel & WHM (Linux)	builds before 1.9.3.1021	version 1.9.3 HF3 (UPD-2609)
Acronis Backup extension for Plesk (Linux)	builds before 1.8.11.638	version 1.8.11 (UPD-2609)

Both fixed builds were published the week before the advisory went public, so this is a patched-but-unpatched-by-you story, and Acronis's advice is to apply immediately on every affected box.

What to do tonight//

1. Find out if you even run it. The plugin isn't always obvious in an inventory. On the server: rpm -qa | grep -i acronis # RPM systems (Alma/CentOS/CloudLinux/Rocky) dpkg -l | grep -i acronis # DEB systems (Ubuntu) In WHM, the plugin shows up under Plugins → Acronis Backup; in Plesk it's listed in the Extensions panel. If either lists a version below 1.9.3 HF3 / 1.8.11 respectively, you're affected.
2. Update via the package manager (per Acronis's plugin docs; the installer registers a stable repo for exactly this): # RPM format yum update acronis-backup-cpanel # DEB format sudo apt update && sudo apt upgrade acronis-backup-cpanel
3. Verify the build number afterward: re-run the query from step 1 and confirm you're at/above 1.9.3.1021 (cPanel) or 1.8.11.638 (Plesk). A package manager saying "up to date" is not the same as the build string matching the advisory.
4. If you can't patch before Saturday: the low-privilege local account is the entry requirement, so tighten who has one: audit sudoers, remove stale SSH keys, and check that web apps aren't running with more local access than they need. That's mitigation, not a fix.
5. Assume the foothold predates the escalation. If an unprivileged account on this box was already compromised (and you probably can't fully rule it out), root-on-the-box means treat credentials stored there as exposed: database passwords, mail accounts, API keys. Acronis has published no specific IoCs and hasn't said what attackers did once they escalated, so the honest posture is: patch now, audit quietly.