Acronis has issued a warning regarding a critical security weakness in its Backup plugin used for cPanel and Web Host Manager (WHM) installations. This vulnerability, identified as CVE-2026-87886 with a CVSS score of 7.8, poses a serious risk as it has been actively exploited in real-world attacks.
Details of the Vulnerability
The vulnerability stems from inadequate file permission settings, leading to a scenario where local privilege escalation is possible. This flaw affects specific versions of the plugin and could allow attackers with minimal access to elevate their privileges. Such an escalation could enable unauthorized actions, including executing arbitrary code that may compromise the application’s confidentiality and integrity.
Acronis has addressed this issue in the 1.9.3 HF3 update, emphasizing the urgency of implementing this fix. The company stated, “This update contains critical security patches and should be installed promptly by all users.” The exploitation has been observed in limited and targeted attacks.
Current Status and Response
Currently, detailed information about the vulnerability, the actors behind the exploitation, or their objectives remains undisclosed. The timeline for when the vulnerability was first detected and exploited is also unclear. Efforts to contact Acronis for further insights are ongoing, and any new information will be shared as it becomes available.
Customers using the Acronis Backup plugin are strongly encouraged to apply the latest updates immediately to mitigate potential risks. Staying current with software patches is essential to maintain the security of data and systems.
Looking Forward
This incident highlights the importance of vigilance in cybersecurity practices, especially for software commonly used in web hosting environments. As organizations continue to face sophisticated cyber threats, maintaining robust security measures and promptly addressing vulnerabilities is critical.
Ensuring regular software updates and monitoring for advisories from vendors like Acronis can help protect against emerging threats and safeguard sensitive information.
