Acronis issued urgent security updates on Tuesday to address a high-severity flaw in its Backup plugin for c Panel & WHM that attackers have already exploited in real-world incidents. The vulnerability, identified as CVE-2026-87886, stems from insecure file permissions within the plugin’s backup tool and associated components. This weakness allows local users to escalate privileges and potentially gain unauthorized access to sensitive system data. The affected software is commonly deployed in shared hosting environments where multiple users manage websites through the c Panel control panel. Acronis confirmed the patch resolves the permission misconfiguration that could be leveraged to execute arbitrary code or read protected files. Users are strongly advised to update to the latest version of the plugin immediately to mitigate risk.
The insecure file permissions allowed unauthorized users to modify or access backup-related files that should have been restricted to administrative accounts. By exploiting this weakness, an attacker with basic user access could manipulate file permissions or replace legitimate binaries with malicious versions. Once executed with elevated privileges, such code could lead to full system compromise, data theft, or disruption of hosting services. Acronis’ security team noted the flaw was particularly dangerous in multi-tenant hosting setups where isolation between user accounts is critical. The company worked closely with c Panel administrators to verify the exploit path before releasing the fix. No evidence suggests the vulnerability was used to breach remote systems directly, but local exploitation remains a serious threat in shared infrastructures.
Hosting providers using the Acronis Backup plugin must apply the patch without delay, as the vulnerability is actively being exploited. Acronis has made the updated plugin available through its official update channels and the c Panel App Catalog. Administrators should verify the plugin version post-update and review system logs for signs of suspicious activity. The company also recommends restricting shell access to untrusted users and auditing file permissions on backup directories as a precaution. While no data loss has been reported from the exploits so far, the potential for harm remains high if left unaddressed. Acronis emphasized that timely patching is the most effective defense against this specific threat vector.
What is CVE-2026-87886 and why is it serious? CVE-2026-87886 is a high-severity vulnerability caused by incorrect file permissions in the Acronis Backup plugin for c Panel & WHM, allowing local users to escalate privileges and potentially compromise system integrity.
Who is affected by this flaw? Any hosting provider or system administrator using the Acronis Backup plugin in a c Panel & WHM environment is at risk, particularly in shared hosting setups with multiple user accounts.
How can users protect themselves from this exploit? Users should immediately update the Acronis Backup plugin to the latest patched version and monitor system logs for unusual activity, while limiting unnecessary local access to servers.