Acronis Patches Exploited Flaw in cPanel Backup Plugin

Acronis has issued an urgent security update for a high-severity vulnerability in its Backup plugin for cPanel and Web Host Manager (WHM) after confirming the flaw has been exploited in limited, targeted attacks. The company disclosed that the vulnerability, tracked as CVE-2026-87886, allows a low-privileged local attacker to escalate privileges on a Linux server without user interaction. The vulnerability, which carries a CVSS score of 7.8, stems from insecure file permissions. According to Acronis, successful exploitation could enable an attacker to perform unauthorized actions or run arbitrary code, potentially impacting the confidentiality and integrity of the application. The flaw affects the Acronis Backup plugin for cPanel/WHM and the Backup extension for Plesk. Acronis stated in its advisory that exploitation has been detected in the wild in limited, targeted attacks against deployments of the cPanel/WHM plugin. The company has not observed any exploitation against its Plesk extension, despite the underlying issue also affecting that product. The assessment of in-the-wild exploitation is based on a single report from a potentially affected customer.