CVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability

What it is

Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.

What to do

Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.

Priority

This week: Schedule into this week’s change window.

Severity (CVSS)

7.8 high

CISA assessment (SSVC)

actively exploited; needs manual effort per target; total control of the affected system

Exploit probability (EPSS, 30 days)

0.2%, higher than 13% of all CVEs

Added to CISA KEV

16 September 2026

CISA fix-by date

19 September 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-276

References

• NIST NVD entry
• CISA KEV entry
• security-advisory.acronis.com/advisories/SEC-10986
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.