Vulnerability

CERT-In Vulnerability Note CIVN-2026-0466
Privilege Escalation Vulnerability in Acronis cPanel Backup Plugin

Original Issue Date:September 18, 2026

Severity Rating: HIGH

Software Affected

Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021
Acronis Backup extension for Plesk (Linux) before build 1.8.11.638

Overview

A vulnerability has been reported in Acronis Backup plugins for cPanel, WHM, and Plesk which could allow a remote attacker to gain elevated privileges on the targeted system.

Target Audience:
System administrators using the affected Acronis Backup plugins.

Risk Assessment:
High risk of privilege escalation.

Impact Assessment:
Potential for unauthorized actions or execution of arbitrary code.

Description

Acronis Backup Plugin for cPanel is a software extension that integrates Acroniss enterprise cloud backup features directly into the cPanel & WHM (Web Host Manager) control panel.

This vulnerability exist in Acronis Backup plugins for cPanel, WHM, and Plesk due to insecure file permissions. A remote attacker could exploit this vulnerability by gaining access to the targeted system.

Successful exploitation of this vulnerability could allow an attacker to elevate privileges, execute arbitrary code, or perform unauthorized actions on the targeted system.

Solution

Apply the latest security updates provided by the vendor:
https://security-advisory.acronis.com/advisories/SEC-10986

Vendor Information

Acronis
https://www.acronis.com

References

https://security-advisory.acronis.com/advisories/SEC-10986

CVE Name
CVE-2026-87886

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India