CVE-2026-87886
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 16, 2026
- US federal agencies must remediate it by Sep 19, 2026 (BOD 22-01)
- Attacked 3 days before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 16, 2026 Sep 15, 2026
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| acronis | acronis backup | < 1.2.3 |
| linux | linux kernel | - |
Related articles
CISA Adds Two Exploited Flaws to KEV and Gives Federal Agencies Three Days to Patch
CISA added CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) to KEV with Sept 27 patch deadline amid active exploitation.
Active Attacks Turn Check Point VPN and Management Flaws Into an Immediate Patch Priority
Check Point confirms active exploits of two critical 9.8 flaws in VPN gateways and management servers. CISA sets Sept 25 patch deadline.
Active Attacks Put Zyxel Switches and Veeam-Protected Windows Endpoints at Risk
CISA warns of active exploitation of Zyxel GS1900 flaw CVE-2026-7273 and Veeam Agent Windows privilege escalation CVE-2026-32996. Patch now.
Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels
Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.
Three Exploited Linux Kernel Flaws Trigger Immediate CISA Patch Deadline
CISA flags three exploited Linux kernel flaws in TLS, AF_ALG and ebtables, setting a September 21, 2026 patch deadline for federal agencies.
Cisco ISE API Authentication Flaw Opens a Remote Path to Root Access
Cisco warns of exploited CVE-2026-76460 in ISE with CVSS 10.0 enabling unauthenticated remote root access. See affected versions, patches, mitigations.
Acronis Warns of Exploited Privilege-Escalation Flaw in cPanel Backup Plugin
Acronis warns CVE-2026-87886 allows local privilege escalation in cPanel & Plesk backup plugins, with limited exploitation reported. Update now.
This product uses the NVD API but is not endorsed or certified by the NVD.