SB20260917226 - Privilege escalation in Acronis Backup plugin for cPanel & WHM and Backup extension for Plesk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917226

SB20260917226 - Privilege escalation in Acronis Backup plugin for cPanel & WHM and Backup extension for Plesk

Published: September 17, 2026

Security Bulletin ID SB20260917226
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect default permissions (CVE-ID: CVE-2026-87886) Exploited

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Note, the vulnerability is being actively exploited in the wild against Acronis Backup plugin for cPanel & WHM deployments.


Remediation

Install update from vendor's website.

References