Acronis Backup flaw exploited: CISA urges urgent patching for cPanel users

What is the Acronis Backup vulnerability?

Acronis, a company known for backup and cyber protection tools, has patched a flaw in its Backup plugin for cPanel and Web Host Manager (WHM) on Linux systems. The flaw, tracked as CVE-2026-87886, involves incorrect default file permissions. This means that files created or managed by the plugin could be accessed or modified by users who should not have that level of access. According to SecurityWeek↗ (opens in a new tab), this bug is considered high-severity because it can allow a local attacker to gain higher privileges on the system, a process known as privilege escalation.

How was the flaw discovered and exploited?

The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue↗ (opens in a new tab) on 16 September 2026. This means there is evidence that attackers are already exploiting the bug in real-world attacks. The Hacker News reports that these are targeted attacks, but details about the victims or the scale of exploitation are not public. CISA’s listing is a strong signal for urgency, as it only adds flaws to the KEV catalogue when there is confirmed exploitation in the wild.

Who is affected?

The vulnerability affects the Acronis Backup plugin for cPanel and WHM on Linux. cPanel and WHM are widely used by web hosting providers to manage websites and servers. If you run a Linux server with this plugin installed, you are at risk. The flaw does not affect Windows versions or other Acronis products, based on current reporting. The plugin is also used as an extension for Plesk, another popular hosting control panel, so users of that platform should also check their systems.

What has Acronis and CISA advised?

Acronis has released a patch for the affected plugin. CISA has instructed all organisations using the plugin to apply the vendor’s mitigation steps immediately. If a patch cannot be applied, CISA recommends discontinuing use of the product to avoid risk. CISA also points to its BOD 26-04 guidance, which prioritises patching based on risk, and requires forensic triage for affected systems. This means organisations should not only patch but also check for signs of compromise.

What should organisations do now?

If you manage a Linux server with Acronis Backup for cPanel or Plesk, check your version and apply the latest updates from Acronis. Review file and directory permissions on your server, especially for backup-related files. Monitor for unusual activity that could indicate privilege escalation attempts. If you cannot patch, consider disabling or removing the plugin until a fix is available. For organisations in regulated sectors, failing to patch could expose you to fines or legal action if customer data is compromised.

Broader context: why does this matter?

Privilege escalation flaws like this are a favourite target for attackers, especially on shared hosting platforms. Once an attacker gains higher privileges, they can access sensitive data, install malware, or disrupt services. The fact that CISA has added this to its KEV catalogue means defenders should treat it as a priority. Recent years have seen a rise in attacks on backup and management tools, as these often have broad access to critical systems.

What happens next?

CISA’s action means US federal agencies must patch the flaw quickly, and other organisations are strongly advised to do the same. Security teams should keep an eye on the KEV catalogue for updates and ensure their patch management processes are up to date. Organisations should also review their backup and recovery plans, as attackers often target these systems to maximise impact.

For now, the best defence is to patch promptly, review permissions, and monitor for suspicious activity.