Acronis Backup Incorrect Default Permissions Vulnerability

cve CVE-2026-87886 2 sources, 2 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Acronis Backup Incorrect Default Permissions Vulnerability Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are res… the claim

What it is to other things

affectsacronis/acronis_backup
NVD
affectslinux/linux_kernel
NVD
made_byacronis
NVD
made_bylinux
NVD

In words only, so not counted until a person confirms one:

affectsacronis/acronis_backup_plugin_for_cpanel_whm
NVD says “Acronis · Acronis Backup plugin for cPanel & WHM”

What each source says

PropertySourceSaidMeans here
Cwes
cwes
CISA Known Exploited VulnerabilitiesCWE-276
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
CWE-276
Read by
field:cwes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Due date
due_date
CISA Known Exploited Vulnerabilities2026-09-19
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2026-09-19
Read by
field:dueDate
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiestrue
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Yes
Read by
field:forensicTriage
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesUnknown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Unknown
Read by
field:knownRansomwareCampaignUse
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Product
product
not compared		CISA Known Exploited VulnerabilitiesBackup
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Backup
Read by
field:product
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—
Product
product
not compared		NVDAcronis Backup plugin for cPanel & WHM
receipt
Source
NVD
Its words
Acronis Backup plugin for cPanel & WHM
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
2026-09-29 17:49 UTCAcronis Backup plugin for cPanel & WHM
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for cPanel & WHM",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.9.3.1021",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup extension for Plesk",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.8.11.638",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for DirectAdmin",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.2.3.238",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@acronis.com"
      }
    ],
    "cisaActionDue": "2026-09-19",
    "cisaExploitAdd": "2026-09-16",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*",
                "matchCriteriaId": "4CB8B9F6-DAB7-4F21-B2B4-0EE01347AC1E",
                "versionEndExcluding": "1.2.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*",
                "matchCriteriaId": "AEA7BEC1-B14B-4ED9-8FA8-D602D612BCA2",
                "versionEndExcluding": "1.8.11",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*",
                "matchCriteriaId": "1F03983F-EC1E-4831-BF34-69331B521543",
                "versionEndExcluding": "1.9.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*",
                "matchCriteriaId": "61BB35F9-D0AB-484A-8C9F-BA79DD51916B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*",
                "matchCriteriaId": "C9442FB3-3ECF-49D7-9940-41F296D7D0BC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*",
                "matchCriteriaId": "E892B84E-B369-4E1A-B9B6-57FBD1F96AFC",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."
      }
    ],
    "id": "CVE-2026-87886",
    "lastModified": "2026-09-18T19:29:35.067",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "security@acronis.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-87886",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-18T12:27:59.851837Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-17T23:18:53.763",
    "references": [
      {
        "source": "security@acronis.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://security-advisory.acronis.com/advisories/SEC-10986"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886"
      }
    ],
    "sourceIdentifier": "security@acronis.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-276"
          }
        ],
        "source": "security@acronis.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for cPanel & WHM",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.9.3.1021",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup extension for Plesk",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.8.11.638",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for DirectAdmin",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.2.3.238",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@acronis.com"
      }
    ],
    "cisaActionDue": "2026-09-19",
    "cisaExploitAdd": "2026-09-16",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*",
                "matchCriteriaId": "4CB8B9F6-DAB7-4F21-B2B4-0EE01347AC1E",
                "versionEndExcluding": "1.2.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*",
                "matchCriteriaId": "AEA7BEC1-B14B-4ED9-8FA8-D602D612BCA2",
                "versionEndExcluding": "1.8.11",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*",
                "matchCriteriaId": "1F03983F-EC1E-4831-BF34-69331B521543",
                "versionEndExcluding": "1.9.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*",
                "matchCriteriaId": "61BB35F9-D0AB-484A-8C9F-BA79DD51916B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*",
                "matchCriteriaId": "C9442FB3-3ECF-49D7-9940-41F296D7D0BC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*",
                "matchCriteriaId": "E892B84E-B369-4E1A-B9B6-57FBD1F96AFC",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."
      }
    ],
    "id": "CVE-2026-87886",
    "lastModified": "2026-09-18T19:29:35.067",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "security@acronis.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-87886",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-18T12:27:59.851837Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-17T23:18:53.763",
    "references": [
      {
        "source": "security@acronis.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://security-advisory.acronis.com/advisories/SEC-10986"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886"
      }
    ],
    "sourceIdentifier": "security@acronis.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-276"
          }
        ],
        "source": "security@acronis.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDAcronis
receipt
Source
NVD
Its words
Acronis
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-04 18:16 UTC
Original
open at the source
2026-09-29 17:49 UTCAcronis
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for cPanel & WHM",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.9.3.1021",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup extension for Plesk",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.8.11.638",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          },
          {
            "defaultStatus": "unaffected",
            "platforms": [
              "Linux"
            ],
            "product": "Acronis Backup plugin for DirectAdmin",
            "vendor": "Acronis",
            "versions": [
              {
                "lessThan": "1.2.3.238",
                "status": "affected",
                "version": "unspecified",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "security@acronis.com"
      }
    ],
    "cisaActionDue": "2026-09-19",
    "cisaExploitAdd": "2026-09-16",
    "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
    "cisaVulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:directadmin:*:*",
                "matchCriteriaId": "4CB8B9F6-DAB7-4F21-B2B4-0EE01347AC1E",
                "versionEndExcluding": "1.2.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:plesk:*:*",
                "matchCriteriaId": "AEA7BEC1-B14B-4ED9-8FA8-D602D612BCA2",
                "versionEndExcluding": "1.8.11",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:*:*:*:*:*:cpanel:*:*",
                "matchCriteriaId": "1F03983F-EC1E-4831-BF34-69331B521543",
                "versionEndExcluding": "1.9.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:-:*:*:*:cpanel:*:*",
                "matchCriteriaId": "61BB35F9-D0AB-484A-8C9F-BA79DD51916B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix1:*:*:*:cpanel:*:*",
                "matchCriteriaId": "C9442FB3-3ECF-49D7-9940-41F296D7D0BC",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:acronis:acronis_backup:1.9.3:hotfix2:*:*:*:cpanel:*:*",
                "matchCriteriaId": "E892B84E-B369-4E1A-B9B6-57FBD1F96AFC",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."
      }
    ],
    "id": "CVE-2026-87886",
    "lastModified": "2026-09-18T19:29:35.067",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "security@acronis.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-87886",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-18T12:27:59.851837Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-17T23:18:53.763",
    "references": [
      {
        "source": "security@acronis.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://security-advisory.acronis.com/advisories/SEC-10986"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886"
      }
    ],
    "sourceIdentifier": "security@acronis.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-276"
          }
        ],
        "source": "security@acronis.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesAcronis
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Acronis
Read by
field:vendorProject
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-04 19:16 UTC
What the source handed over
{
  "cveID": "CVE-2026-87886",
  "cwes": "CWE-276",
  "dateAdded": "2026-09-16",
  "dueDate": "2026-09-19",
  "forensicTriage": "Yes",
  "knownRansomwareCampaignUse": "Unknown",
  "notes": "https://security-advisory.acronis.com/advisories/SEC-10986 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87886",
  "product": "Backup",
  "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "shortDescription": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
  "vendorProject": "Acronis",
  "vulnerabilityName": "Acronis Backup Incorrect Default Permissions Vulnerability"
}
—

vulnerability

Acronis Backup Incorrect Default Permissions Vulnerability
zetlyn/cve-kev · 2026-09-16
cwes CWE-276 due_date 2026-09-19 exploited yes forensic_triage true known_ransomware_campaign_use Unknown product Backup vendor_project Acronis
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
zetlyn/cve-nvd · 2026-09-17
product Acronis Backup plugin for cPanel & WHM status Analyzed vendor Acronis source