CVE-2026-87886

Published: Sep 17, 2026Modified: Sep 18, 2026CISA KEV

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: security@acronis.com (Secondary)

Description

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Affected (6)

Products: Acronis: Acronis Backup

Acronis

1 product

Acronis Backup

Configuration A

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Acronis Acronis Backup	version < 1.9.3
Acronis Acronis Backup	version < 1.2.3
Acronis Acronis Backup	version < 1.8.11
Acronis Acronis Backup	Version 1.9.3
Acronis Acronis Backup	Version 1.9.3 hotfix1
Acronis Acronis Backup	Version 1.9.3 hotfix2

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (2)

https://security-advisory.acronis.com/advisories/SEC-10986

Source: security@acronis.com

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.