CVE-2026-87886

EUVD-2026-82595
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.22%
Affected Products (NVD)
VendorProductVersion
acronisacronis_backup
𝑥
< 1.2.3
acronisacronis_backup
𝑥
< 1.8.11
acronisacronis_backup
𝑥
< 1.9.3
acronisacronis_backup
1.9.3
acronisacronis_backup
1.9.3:hotfix1
acronisacronis_backup
1.9.3:hotfix2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://security-advisory.acronis.com/advisories/SEC-10986
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886