Incorrect default permissions in Acronis Backup extension for Plesk for Linux and Acronis Backup plugin for cPanel & WHM for Linux - CVE-2026-87886
Published: September 17, 2026
Vulnerability identifier: #VU150657
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87886
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.
Note, the vulnerability is being actively exploited in the wild against Acronis Backup plugin for cPanel & WHM deployments.
Affected software
Acronis Backup extension for Plesk for Linux
Acronis Backup plugin for cPanel & WHM for Linux
Acronis Backup plugin for cPanel & WHM for Linux
How to mitigate CVE-2026-87886
Install updates from vendor's website.
Acronis Backup extension for Plesk for Linux - update to 1.8.11.638
Acronis Backup plugin for cPanel & WHM for Linux - update to 1.9.3.1021
Acronis Backup plugin for cPanel & WHM for Linux - update to 1.9.3.1021