CVE-2026-87886
Published 2026-09-17 · Updated 2026-09-18 · Source security@acronis.com
Summary
CVE-2026-87886 is a high-severity (CVSS 7.8) vulnerability in Acronis Backup. CISA added it to the Known Exploited Vulnerabilities catalog on September 16, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 19, 2026. CISA does not currently list it as used in ransomware campaigns. Acronis has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 2 known-exploited Acronis vulnerabilities →Description
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Acronis — Backup
Name: Acronis Backup Incorrect Default Permissions Vulnerability
Date added: 2026-09-16 · Due: 2026-09-19
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.