DEV Community

jeffrey
jeffrey

Posted on

Why CVE-2026-87886 Turns a Hosting Backup Plugin Into a Privilege Escalation Path

#security #vulnerability #cve202687886 #acronis

Why CVE-2026-87886 Turns a Hosting Backup Plugin Into a Privilege Escalation Path

Vulnerability overview

CVE-2026-87886 is a privilege escalation vulnerability in the Acronis Backup plugin for cPanel & WHM (Linux) and the Acronis Backup extension for Plesk (Linux). CERT-In published the note as CIVN-2026-0466 with a HIGH severity rating on 18 September 2026, and Acronis tracks the fix under advisory SEC-10986. The affected builds are Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 and Acronis Backup extension for Plesk before build 1.8.11.638.
The plugin integrates Acronis enterprise cloud backup features directly into the cPanel & WHM control panel and the Plesk control panel. Because that integration runs with elevated privileges on the hosting node, any weakness in how the plugin handles its own files has consequences beyond the backup feature itself.
This article takes the attack-path and risk reasoning view of the same documented facts.

Mechanism and exploitation conditions

The documented root cause is insecure file permissions. CERT-In states that the vulnerability exists because of insecure file permissions in the Acronis Backup plugins for cPanel, WHM and Plesk, and that a remote attacker could exploit it by gaining access to the targeted system. In practice this means the plugin ships or creates files whose ownership or mode allows a lower-privileged local user to read or modify content that the plugin later consumes in a privileged context.
Two conditions matter for exploitation. First, the attacker needs a foothold on the host: the note describes an attacker who has gained access to the targeted system, so this is not a pre-authentication remote exploit against a hardened perimeter. Second, the affected plugin must be installed and running on that host. On shared hosting, a single compromised customer account is often enough to satisfy the first condition, which is what makes a local privilege escalation in a hosting panel component operationally serious.
The advisory does not publish a proof-of-concept, and no public exploitation has been confirmed. The mechanism should therefore be described as documented rather than demonstrated.

Impact

Successful exploitation allows an attacker to elevate privileges, execute arbitrary code, or perform unauthorized actions on the targeted system, according to CERT-In. On a hosting node that translates into control over the panel and, potentially, over other tenants hosted on the same machine. Backup plugins are especially sensitive because they handle credentials and data for many accounts at once.
The impact is bounded by the requirement for an initial foothold, but it is amplified by the multi-tenant context. A privilege boundary that is supposed to separate one customer account from the host is exactly the boundary this class of flaw weakens.

Affected products and scope

  • Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021
  • Acronis Backup extension for Plesk (Linux) before build 1.8.11.638 Systems running a build at or above those versions are not affected by this advisory. Administrators should confirm the installed plugin build rather than the panel version, because the panel and the plugin are versioned independently. The advisory does not enumerate every deployment topology, so treat any host where the plugin is installed and reachable by lower-privileged users as in scope until the build is verified.

Exposure context

A ZoomEye query for the cPanel application fingerprint returns a very large global population of internet-facing cPanel instances, which shows how common the underlying panel is rather than how many hosts run the vulnerable plugin build. The two numbers are not the same, and the plugin build is what determines exposure here.
Because the flaw is a local privilege escalation, internet-facing panel count is a weak proxy for risk. The more useful inventory question is which managed hosts have the Acronis plugin installed and at which build. Where ZoomEye evidence is available it should be used to locate panel instances, then combined with configuration management data to determine plugin versions.

Remediation and mitigations

  1. Upgrade the Acronis Backup plugin for cPanel & WHM to build 1.9.3.1021 or later, and the Acronis Backup extension for Plesk to build 1.8.11.638 or later, following the vendor advisory SEC-10986.
  2. Verify the installed build after upgrading, and confirm file ownership and permissions on plugin directories match the vendor's expectations.
  3. Restrict which accounts on a shared host can reach the plugin's files, and review whether any non-administrative user can write to plugin-managed paths.
  4. Treat a compromised customer account on an affected host as a potential precursor to host-level compromise, and review logs for privilege escalation attempts around the plugin.
  5. Where immediate patching is not possible, isolate the plugin from lower-privileged users and monitor for unexpected changes to its files.

References

Top comments (0)