Acronis has released security patches for its Backup plugin for cPanel & WHM and Backup extension for Plesk following the identification of a limited, targeted exploit of a high-severity local privilege-escalation vulnerability This article explores acronis released security. . The vulnerability, tracked as CVE-2026-87886, affects Acronis backup components running on Linux-based systems in shared hosting and managed server environments.
This flaw, rated CVSS vector 7.5, does not require user interaction, making it particularly concerning following an initial compromise. A threat actor could exploit a compromised hosting account, weak credentials, a vulnerable web application, or another attack path. However, public vulnerability information and patches can trigger broader scanning activities, as attackers frequently attempt to identify unpatched systems after disclosure.
Security teams should investigate servers for signs of unauthorized local access, unexpected privilege changes, suspicious elevated processes, and unusual modifications involving Acronis-related files or directories. Defenders should also review authentication logs, shell activity, web-shell alerts, cPanel and Plesk account events, backup access records, and changes to sensitive system permissions. Organizations unable to patch immediately should restrict shell access for untrusted accounts, reduce local access exposure, closely monitor privileged activity, and isolate backup infrastructure from standard hosting workloads when possible.
Join 16,000+ SOC teams using ANY.RUN to enhance threat investigations and minimize manual workload.
