Acronis has released security patches for its Backup plugin for cPanel & WHM and Backup extension for Plesk after identifying limited, targeted exploitation of a high-severity local privilege-escalation vulnerability in the wild This article explores acronis released security. . Tracked as CVE-2026-87886, the security flaw affects Linux-based Acronis backup components used in shared hosting and managed server environments.
In Acronis deployments, improper file permissions can allow a low-privileged user to access or execute actions outside their authorized scope. A threat actor could exploit a compromised hosting account, weak credentials, or a vulnerable web application to gain access, then abuse the Acronis component to escalate privileges on the underlying server. Public vulnerability information and patches can trigger broader scanning activities, as attackers frequently attempt to identify unpatched systems after disclosure.
Security teams should investigate servers for signs of unauthorized local access, unexpected privilege changes, suspicious elevated processes, and unusual modifications involving Acronis-related files or directories. Defenders should also review authentication logs, shell activity, web-shell alerts, cPanel and Plesk account events, backup access records, and changes to sensitive system permissions. Organizations that cannot patch immediately should restrict shell access for untrusted accounts, reduce local access exposure, closely monitor privileged activity, and isolate backup infrastructure from standard hosting workloads where possible.
