CVE-2026-87886 is a high-severity local privilege escalation vulnerability affecting Acronis's Linux-based backup integrations for hosting control panels. The flaw resides in insecure file permissions within the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk, both of which link these widely-used hosting management platforms to Acronis's backup and recovery infrastructure.

The following version(s) are affected:

• Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021
• Acronis Backup extension for Plesk (Linux) before build 1.8.11.638

Not affected / patched version:

• Acronis Backup plugin for cPanel & WHM (Linux) build 1.9.3 HF3 (1.9.3.1021) and later
• Acronis Backup extension for Plesk (Linux) build 1.8.11.638 and later

Successful exploitation may allow attackers to:

• Escalate privileges on an affected Linux server from a low-privileged, authenticated account
• Gain elevated access sufficient to perform unauthorized actions or run arbitrary code, affecting the confidentiality and integrity of the hosting environment

CERTVU recommends the following:

1. Apply the vendor patch immediately

   Upgrade the Acronis Backup plugin for cPanel & WHM to build 1.9.3 HF3 (1.9.3.1021) or later.

2. Patch the Plesk extension as well

   Upgrade the Acronis Backup extension for Plesk to build 1.8.11.638 or later, even though no exploitation has been reported there yet.

3. Prioritize internet-facing hosting environments

4. Apply least privilege