Acronis cPanel Backup Plugin Exploited in Targeted Attacks

Acronis has warned that a high‑severity security flaw in its Backup plugin for cPanel & WHM deployments was exploited in the wild. The vulnerability, tracked as CVE-2026-87886 and carrying a CVSS score of 7.8, allows local privilege escalation through insecure file permissions on affected Linux systems. It affects versions of the Acronis Backup plugin used within cPanel and Web Host Manager environments.¹

The insecure file permissions let an attacker with system-level privileges execute arbitrary code inside the backup environment itself—bypassing standard web application firewalls (WAFs). Similar vulnerabilities affecting commercial database plugins were previously exploited by ransomware groups starting around 2017, resulting in massive data exfiltration and operational disruption for managed service provider clients. This incident demonstrates how supply‑chain weaknesses can be leveraged for targeted exploitation.¹

Because the bug requires low‑level system privileges not exposed directly through user applications, it is difficult for end users to detect without monitoring logs for anomalous activity. Successful exploits grant attackers root access, allowing manipulation of files and backups. Attack vectors observed in this case involved unauthorized code execution that could circumvent even hardened WAF configurations.¹

Users should immediately verify that their backups are intact before applying patches because corrupted or incomplete restores will only exacerbate damage if a breach occurs. Acronis has urged affected customers to apply the latest patch as soon as possible. Patching quickly mitigates risk but does not address underlying architectural issues that could create similar flaws again. Security teams must therefore balance detection at runtime with proactive hardening of supply chains, ensuring carrier updates and vendor releases reach servers promptly to prevent further exploitation. Immediate verification, patching, and continuous log monitoring remain essential defenses against such privilege escalation attacks.