Privilege Escalation Vulnerability in Acronis Backup Plugins for cPanel/WHM and Plesk (CVE‑2026‑87886)
What It Is — Acronis Backup’s plugin for cPanel & WHM and its Plesk extension ship with default file‑system permissions that are overly permissive. An attacker who can write to the plugin directory could elevate privileges to the host operating system.
Exploitability — No public exploit has been observed, but the vulnerability is rated CVSS 7.5 (High), indicating a realistic path to privilege escalation once an adversary gains limited access.
Affected Products —
- Acronis Backup plugin for cPanel & WHM
- Acronis Backup extension for Plesk
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Default permissive settings violate the “least‑privilege” control objective, a cornerstone of continuous assurance across frameworks.
- Audit‑ready evidence – Organizations must be able to prove that permission baselines are documented, monitored, and remediated, otherwise auditors will flag a control gap.
- Defensible posture for buyers – Enterprise customers increasingly demand proof that backup services enforce strict permission controls before signing contracts.
Recommended Actions
- Apply the vendor‑released patch or configuration update immediately.
- Conduct a permission baseline review of all Acronis Backup components; tighten file‑system rights to the minimum required for operation.
- Enable continuous monitoring of privileged file‑system changes and integrate alerts into your SIEM.
- Update your control‑evidence repository to reflect the corrected permission settings for future audits.
Source: CISA KEV – CVE‑2026‑87886