Acronis: Actively Exploited Vulnerability in cPanel Backup Plugin

Acronis has disclosed a vulnerability in its backup plugin for the cPanel, WebHost Manager (WHM) and Plesk hosting control panels. The flaw allows local privilege escalation on a Linux server and, according to the developer, is already being exploited by attackers.

Acronis's plugins connect a hosting control panel to the company's infrastructure: through the cPanel and Plesk interfaces, administrators can create backups and restore sites, files, databases, mailboxes and hosting accounts. cPanel, WHM and Plesk themselves are widely used by hosting providers and system administrators to manage servers and websites.

What is known about the vulnerability

The issue has been assigned the identifier CVE-2026-87886 and a severity score of 7.8 on the CVSS scale. An attacker with low-level privileges can use it to elevate their permissions on a vulnerable Linux server, gaining access to confidential data, the ability to modify it and to disrupt the system's operation — all without any user interaction.

Detailed technical information is not being published yet: Acronis wants to give administrators time to install the updates before disclosing details that would make it easier to develop exploits. A first brief advisory was released last weekend, and today the company expanded on it.

Attacks have already been recorded

Acronis claims that exploitation of the vulnerability was spotted “in limited, targeted attacks” on deployments of the plugin for cPanel and WHM. That said, in a comment to BleepingComputer the company clarified that this conclusion is based on a single report from a “potentially affected” customer. No indicators of compromise could be identified, and exactly when the activity took place and what the attackers achieved beyond privilege escalation has not been disclosed.

Who is affected and what to do

The vulnerability affects the following product versions:

• Acronis Backup plugin for cPanel and WHM — builds older than 1.9.3.1021 (fixed in version 1.9.3 HF3);
• Acronis Backup extension for Plesk — builds older than 1.8.11.638 (fixed in version 1.8.11).

Anyone using Acronis backup integrations for cPanel, WHM and Plesk is advised to install the available updates without delay.

Source: Bleeping Computer