Critical Privilege Escalation Flaw Actively Exploited in Acronis cPanel Backup Plugin
A critical local privilege escalation vulnerability (CVE-2026-87886) in Acronis's backup plugin for cPanel, WHM, and Plesk is being actively exploited in targeted attacks, allowing low-privileged users to gain root-level access on affected Linux servers. Backup and hosting management plugins are high-value targets because they typically operate with elevated permissions and are deployed across large numbers of production servers. The fact that exploitation was detected before widespread patching highlights the danger of delayed remediation for internet-facing infrastructure components. This incident underscores that even trusted security and backup tools can become critical attack vectors if not kept current and monitored.
Tactical Insight
Immediate actions
- Apply the Acronis-issued patch or upgrade the cPanel/WHM/Plesk backup plugin to the latest fixed version immediately.
- Audit all servers running the affected plugin and restrict local user accounts to the minimum necessary privileges until patching is complete.
- Enable real-time alerting for unexpected privilege escalation events on Linux hosts running the affected plugin.
Long-term improvements
- Maintain a complete, up-to-date software inventory including all third-party plugins and backup agents deployed across your environment.
- Implement an emergency patching SLA (e.g., 24–72 hours) for critical vulnerabilities with CVSS scores of 7.0 or higher on internet-facing or production systems.
- Enforce the principle of least privilege for all backup and hosting management service accounts to limit the blast radius of any future exploitation.
Detection measures
- Deploy file integrity monitoring (FIM) and host-based intrusion detection (HIDS) on servers running cPanel, WHM, and Plesk to catch post-exploitation activity.
- Centralize and review system logs for suspicious sudo usage, SUID binary execution, or unexpected process ownership changes.
- Subscribe to Acronis security advisories and integrate vendor CVE feeds into your vulnerability management platform for timely awareness.