DEV Community

kozhevniko
kozhevniko

Posted on

CVE-2026-87886: Insecure File Permissions in the Acronis Backup Plugin on Shared Hosting

#security #vulnerability #exploitedinthewild

CVE-2026-87886: Insecure File Permissions in the Acronis Backup Plugin on Shared Hosting

A backup agent with more authority than its file permissions admit

Backup software runs with the privileges needed to read anything on a host. The Acronis Backup plugin for cPanel and WHM, the extension for Plesk, and the plugin for DirectAdmin sit inside control panels that already hold administrative power over every hosted account. CVE-2026-87886 is a file permission problem in that position.
CISA added the flaw to the Known Exploited Vulnerabilities catalog on 16 September 2026 with a due date of 19 September, a three-day window. NVD records a CVSS 3.1 base score of 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

What the vulnerability is

The NVD description states local privilege escalation due to insecure file permissions. The affected products are the Acronis Backup plugin for cPanel and WHM on Linux before build 1.9.3.1021, the Acronis Backup extension for Plesk on Linux before build 1.8.11.638, and the Acronis Backup plugin for DirectAdmin on Linux before build 1.2.3.238.
The vector needs reading in full. It requires local access and low privileges, needs no user interaction, and is not scope changed, so the exploit stays inside the security authority it starts in. The impact across confidentiality, integrity and availability is rated high. In practice, an account that starts with ordinary user rights reaches files a backup agent should never expose.

Why shared hosting amplifies a local flaw

On a single-purpose server, a local privilege escalation is serious. On shared hosting it is a boundary problem between customers. Any tenant with a shell account shares the filesystem with the control panel, the backup agent, and every other tenant.
Control panel plugins are also a supply chain that hosting providers rarely audit deeply. The provider installs the plugin once and it runs with elevated permissions across all accounts. Its file permissions are inherited by every user on the system.
The KEV deadline reflects that. CISA's required action points to BOD 26-04 and directs stakeholders to evaluate each asset's internet exposure, but for this class the relevant exposure is not a public port. It is how many hosting tenants can execute code locally on the affected server.

Remediation

Update each affected plugin to the fixed build named above: 1.9.3.1021 for cPanel and WHM, 1.8.11.638 for Plesk, and 1.2.3.238 for DirectAdmin. Confirm the installed build rather than the version shown in the panel's plugin list, since those can differ after a partial update.
Correct the underlying file permissions on the paths the plugin uses. The advisory names insecure permissions as the cause; restoring secure ownership and mode settings reduces the window while the update is scheduled. Acronis's advisory is the authority on the exact paths.
Review local accounts for the period before patching. A local privilege escalation leaves traces: unexpected file reads on backup directories, new setuid binaries, or processes running as the backup service account outside a backup window. Check whether tenant accounts gained access to paths belonging to other tenants.
Treat backup data as compromised in the worst case. The plugin exists to read every file it is configured to protect, which means escalation through it may expose data from every hosted account. Where the timing of any potential access cannot be narrowed down, that scope should drive the disclosure decision rather than a count of affected servers.

References

Top comments (0)