CVE-2026-87886: Acronis Backup Plugin Privilege Escalation Flaw Exploited in Targeted Attacks

**Executive summary:** Acronis disclosed CVE-2026-87886, a high-severity (CVSS 7.8) local privilege-escalation in Acronis Backup integrations for cPanel & WHM and Plesk that arises from insecure default file permissions; an authenticated low-privileged user on a Linux hosting server can potentially escalate to higher privileges (including root) and execute arbitrary code. Exploitation has been observed in targeted attacks against cPanel deployments, CISA added the CVE to its Known Exploited Vulnerabilities catalog with an agency remediation deadline, and Acronis released fixed builds (cPanel: 1.9.3 HF3 build 1021 / 1.9.4 build 1022; Plesk: 1.8.11 build 638). Immediate patching, inventorying affected hosts, and forensic triage for previously vulnerable systems are recommended.