CVE-2026-87886: Acronis cPanel Backup Plugin Is on CISA KEV - Patch to 1.9.3 HF3

The Situation

CVE-2026-87886 is a local privilege escalation in Acronis's hosting-panel backup integrations. Acronis's CNA description on NVD is one sentence: local privilege escalation due to insecure file permissions, CWE-276, Linux only.

Acronis's own CVSS v3.0 is 7.8 HIGH: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. That score is vendor-reported. We did not recompute it. Attack vector is local, privileges required low, no user interaction.

On 16 September 2026, CISA added it to the Known Exploited Vulnerabilities catalog as Acronis Backup Incorrect Default Permissions Vulnerability. Catalog version we pulled this morning: 2026.09.25, 1726 entries. dateAdded 2026-09-16, federal due date 2026-09-19, knownRansomwareCampaignUse Unknown, forensicTriage Yes. CISA's short description names the cPanel & WHM plugin and the Plesk extension.

This is not a website-owner plugin. Acronis's cPanel manual (revision 14 May 2026) describes it as an add-on installed as root that connects the panel to Acronis Cyber Protect Cloud so the whole server is backed up and accounts can be restored from inside WHM/cPanel.

If you sell shared or reseller hosting with Acronis on the panel, a low-priv local account on that box is the attacker the CVSS vector describes.

Version Floors

From NVD (CNA: security@acronis.com, published 17 Sep 2026, status Analyzed) plus Acronis's product update notices:

cPanel & WHM plugin (Linux): all builds before 1.9.3.1021. NVD also lists 1.9.3, 1.9.3 hotfix1, and 1.9.3 hotfix2 as vulnerable. Fixed as 1.9.3 HF3 (build 1.9.3.1021). Update notice: UPD-2609-3d72-20a7.
Plesk extension (Linux): all builds before 1.8.11.638. Fixed as 1.8.11. Update notice: UPD-2609-efb0-50b2.
DirectAdmin plugin (Linux): all builds before 1.2.3.238. Fixed as 1.2.3. Update notice: UPD-2609-6ade-5b2e. CISA's KEV short description does not name DirectAdmin; the CNA record does. Inventory it anyway.

Umbrella advisory: SEC-10986.

France's CERT Santé (18 Sep 2026) restates the same three floors and says there is no published workaround. We did not find a vendor workaround either.

Exploitation Status, Labeled

Vendor (cPanel notice / SEC-10986, as quoted by The Hacker News and BleepingComputer): "Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments." The 1.9.3 HF3 notice, quoted by THN: "This update contains fixes for 1 high-severity security vulnerability and should be installed immediately by all users."
Vendor to BleepingComputer (15 Sep 2026): the in-the-wild assessment rests on a single report from a "potentially affected" customer. Acronis identified no specific indicators of compromise and did not say when the activity happened or what the attackers did after the escalation.
Plesk notice (as reported by Web Hosting Today): update "is recommended for all users" and Acronis sees "no signs of active exploitation" on Plesk. Treat Plesk as same bug, no vendor-claimed wild use.
CISA KEV is independent confirmation that CISA believes the CVE has been exploited. CISA Coordinator SSVC on NVD: exploitation: active, automatable: no, technicalImpact: total.
Ransomware: KEV field is Unknown. Do not write "ransomware."
Public PoC: CERT Santé, 18 Sep 2026: none in open sources. We are not publishing a mechanism.

The "how" is unpublished. CWE-276 plus AV:L/PR:L is consistent with a low-priv local user abusing overly permissive files the plugin dropped. That is reading the CWE and the vector, not a reconstructed exploit. Do not chmod-hunt this as a substitute for the package update.

Why Shared Hosting Cares

On a multi-tenant cPanel box the interesting attacker is already a customer, or anyone who popped one WordPress site into a shell. That is exactly PR:L / AV:L. The plugin runs server-wide: it mounts backups, talks to the protection agent, and (if you enabled it) lets accounts restore files, databases, mailboxes, and entire accounts from the panel.

Acronis's manual is explicit: "Only the server administrator has permission to manage backups on the web hosting server. Resellers and end users can only access and restore their data if the self-service recovery feature is available for their accounts." Self-service is a product feature, not this CVE. The CVE is permissions on files the plugin installed.

CISA's forensicTriage: Yes is a BOD 26-04 instruction for federal agencies, not a hosting SLA. For a commercial fleet it still means: patching is not the whole ticket on any box that ran a vulnerable build. Look for unexplained root activity. Acronis has not given you a grep.

This sits next to a month of panel-plane privilege bugs (LiteSpeed Enterprise before 6.3.7; cPanel CalDAV CVE-2026-87899, which is not in KEV as of catalog 2026.09.25). Those are separate CVEs. Do not conflate them.

What to Do Now

1. Find the package

RPM:

rpm -q acronis-backup-cpanel

DEB:

dpkg -l acronis-backup-cpanel

If the package is absent, you are not running this plugin. Stop. Do not install it to "check."

Fleet:

for h in $(cat hosts.txt); do
  ssh root@$h 'rpm -q acronis-backup-cpanel 2>/dev/null || dpkg -l acronis-backup-cpanel 2>/dev/null | awk "/^ii/{print}"' | sed "s|^|$h: |"
done

Anything below 1.9.3.1021 on cPanel is in the CNA range. Compare the full NEVRA, not the marketing "1.9.3" string - hotfix1 and hotfix2 of 1.9.3 are still vulnerable.

Plesk and DirectAdmin: use each panel's extension/plugin list and the Acronis update notice for that product. We are not inventing those package names.

2. Patch - commands from Acronis's cPanel plugin manual

The 14 May 2026 manual, section Updating the plugin:

# RPM
yum update acronis-backup-cpanel

# DEB
sudo apt update
sudo apt upgrade acronis-backup-cpanel

That is the vendor update path. The installer (install_acronis_cpanel.sh) is for first install, not this CVE. Do not curl it over a production box unless you intend to install the plugin.

Plesk: follow UPD-2609-efb0-50b2 to 1.8.11.638+. DirectAdmin: UPD-2609-6ade-5b2e to 1.2.3.238+.

3. Verify

rpm -q acronis-backup-cpanel
# or
dpkg -l acronis-backup-cpanel

Confirm the installed build is ≥ 1.9.3.1021. Then check the plugin still answers in WHM: Plugins → Acronis Backup. A package bump that silently breaks the Python service (acronis-backup-srv.sh / acronis_plugin) will show up as a restore outage, not a CVE.

4. After you patched

CISA asked federal agencies for forensic triage. You are probably not FCEB. Still:

Unexplained root crons, new setuid binaries, unexpected users in /etc/passwd.
Permission flips under /usr/local/cpanel/base/3rdparty/acronisbackup/ and /usr/lib/Acronis/ - those paths are from the manual, not an IoC list. Acronis published no IoCs.
Backup/restore jobs that ran as the wrong uid.

If you cannot patch today: there is no vendor workaround. Restrict local shell (jails, no jailed-shell write to plugin temp dirs - the manual already warns about that for a different reason). That shrinks PR:L accounts. It does not fix CWE-276.

What We Don't Know Yet

Exact files and the privilege gained. Vendor held the mechanism. CERT Santé wrote "administrateur du serveur"; that is CERT Santé's reading, not an Acronis quote. Stick to "local privilege escalation" until Acronis publishes more.
Who, when, what after root. One customer report, no IoCs, no timeline.
Whether DirectAdmin was exploited. Not in the KEV short description; still in the CNA affected list.
Open-source / "just the agent." This CVE is the panel plugins. Do not assume Cyber Protect Cloud Agent C26.09 (a different feed item) is the same patch.

Primary sources: SEC-10986, NVD CVE-2026-87886, CISA KEV JSON, Acronis cPanel plugin manual (update commands), The Hacker News 16 Sep 2026, BleepingComputer 15 Sep 2026.