CVE-2026-87886 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 20.81%

Affected Products (NVD)

Vendor	Product	Version
acronis	acronis_backup	𝑥 < 1.2.3
acronis	acronis_backup	𝑥 < 1.8.11
acronis	acronis_backup	𝑥 < 1.9.3
acronis	acronis_backup	1.9.3
acronis	acronis_backup	1.9.3:hotfix1
acronis	acronis_backup	1.9.3:hotfix2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-276 - Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

Vulnerability Media Exposure

[GERMAN] Angreifer attackieren Acronis Backup für cPanel/WHM und Plesk
Aufgrund von laufenden Attacken müssen Admins Acronis Backup für cPanel/WHM und Plesk aktualisieren.
Published: 2026-09-16T07:37:00+00:00
[ENGLISH] Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild. The vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions - Acronis Backup plugin for cPanel & WHM (Linux
Published: 2026-09-16T16:38:54+05:30

References

https://security-advisory.acronis.com/advisories/SEC-10986

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886