Acronis has disclosed a high-severity local privilege escalation vulnerability affecting its backup plugin for cPanel, WebHost Manager (WHM), and Plesk — and reports indicate the flaw is being exploited in the wild. For hosting providers and any organization running shared or managed Linux hosting infrastructure, this is a serious event: a local escalation primitive on a cPanel server means an attacker who already holds a low-privileged foothold (compromised web account, webshell, or stolen cPanel credentials) can move to root and from there compromise every tenant on the box.
Hosting platforms are force multipliers for attackers. A single cPanel/WHM server frequently hosts dozens to hundreds of customer sites. Root access on that server exposes databases, mail spools, SSL private keys, and backup archives for all of them — and Acronis backup plugins, by design, run with elevated privileges to perform backup and restore operations. That makes backup software a high-value target class, and this disclosure follows a well-established pattern of attackers hunting backup infrastructure specifically (to destroy recovery options before ransomware deployment, or to harvest credentials and data at scale).
If you operate cPanel, WHM, or Plesk servers with the Acronis backup plugin installed, treat this as an emergency patch-and-hunt event, not a routine update.
Technical Analysis
Affected component: Acronis backup plugin (the integration layer that embeds Acronis backup functionality into cPanel, WHM, and Plesk control panels) on Linux systems.
Vulnerability class: Local privilege escalation (LPE). A user with a low-privileged local session — for example, a standard cPanel account user, a webshell running as the web server user, or a compromised reseller account — can leverage the flaw in the Acronis plugin to elevate privileges, with the realistic worst case being root on the hosting server.
Why this component is dangerous: Backup plugins installed into control panels typically execute with elevated or root-equivalent rights because they must read files across all hosted accounts, write archives to protected locations, and interface with system-level services. Any flaw in the privilege boundary between the panel user context and the plugin's privileged backend (improper input validation in plugin-invoked operations, unsafe handling of user-controlled paths or parameters passed to privileged routines, or insecure IPC/socket permissions) becomes a direct LPE primitive.
Exploitation status: Acronis reports the vulnerability may be (or is being) exploited in the wild. Defenders should assume active exploitation. At the time of reporting, a specific CVE identifier and CVSS score had not been published in the primary coverage — monitor the Acronis security advisory and CISA KEV for assignment and any federal remediation deadline.
Likely pre-conditions and attack chain (defender's model):
- Attacker obtains low-privileged access to a hosted account (credential stuffing against cPanel login, compromised CMS such as WordPress, or a dropped webshell).
- Attacker invokes the vulnerable Acronis plugin functionality from the low-privileged context to trigger the escalation path in the privileged plugin backend.
- Post-escalation: root-level persistence (new sudoers entries, SSH authorized_keys, cron jobs, systemd units), tampering with or deleting backups, mass data theft across tenants, and lateral movement.
Note that step 1 is frequently web-facing. Your Apache/nginx access logs and cPanel account activity are as important to the hunt as the plugin itself.
Detection & Response
The exploitation itself may be quiet — the high-signal telemetry is the post-exploitation behavior: a web-server or cPanel-account process context suddenly spawning root-owned shells, writing to privileged persistence locations, or touching Acronis plugin binaries/configuration. The detections below focus there, because that's where a veteran analyst will actually catch this.
---
title: Web Server or cPanel User Process Spawning Interactive Shell
tid: 9c2f4a81-3e7b-4d5a-9f1c-8a6b2d4e7f30
status: experimental
description: Detects interactive shells spawned by web server, PHP, or cPanel-related processes, consistent with webshell activity that may precede exploitation of the Acronis plugin LPE on hosting servers.
references:
- https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059.004
- attack.privilege_escalation
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/httpd'
- '/apache2'
- '/nginx'
- '/php-fpm'
- '/lsphp'
- '/cpanel'
selection_child:
Image|endswith:
- '/bash'
- '/sh'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/nc'
- '/ncat'
- '/socat'
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts invoked by control panel tasks (rare for interactive shells)
level: high
---
title: Privileged Persistence Modification on Linux Hosting Servers
tid: 4e8b1c63-7f2a-4b9d-a3e5-6c1d9f8b2a47
status: experimental
description: Detects writes to common Linux persistence and privilege artifacts (sudoers, authorized_keys, cron, systemd units) that follow successful local privilege escalation, including exploitation of control panel backup plugin flaws.
references:
- https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
- https://attack.mitre.org/techniques/T1098/004/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.t1098.004
- attack.t1053.003
- attack.t1543.002
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- '/etc/sudoers'
- '/etc/sudoers.d/'
- '/.ssh/authorized_keys'
- '/etc/cron.d/'
- '/etc/crontab'
- '/var/spool/cron/'
- '/etc/systemd/system/'
- '/lib/systemd/system/'
filter_known_writers:
Image|endswith:
- '/sshd'
- '/systemd'
- '/crond'
- '/cron'
condition: selection and not filter_known_writers
falsepositives:
- Configuration management (Ansible, Puppet, Chef) — filter by known management process trees
- Package manager operations during legitimate updates
level: high
---
title: Acronis Plugin Component Executing Unexpected Commands
tid: 2b7d5e90-1a4c-4f8e-b6d3-9e2a7c5f1b84
status: experimental
description: Detects Acronis backup plugin/agent processes spawning shell or system utility children outside of expected backup operation patterns, which may indicate abuse of the plugin's privileged execution context.
references:
- https://www.bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin/
- https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.privilege_escalation
- attack.t1068
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- 'acronis'
- 'BackupAndRecovery'
- 'mms'
selection_child:
Image|endswith:
- '/bash'
- '/sh'
- '/su'
- '/sudo'
- '/useradd'
- '/usermod'
- '/chmod'
- '/curl'
- '/wget'
condition: selection_parent and selection_child
falsepositives:
- Acronis pre/post backup scripts legitimately configured by administrators — baseline and allowlist known script invocations
level: medium
// Hunt: shell/system utility execution under web server or Acronis plugin contexts
// Requires Syslog or CEF ingestion of Linux process audit data (auditd/sysmon-for-linux) into Sentinel
union isfuzzy=true
(Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl", "nc", "ncat", "socat", "su", "sudo", "useradd", "usermod")
| extend SyslogMsg = tostring(SyslogMessage)
| where SyslogMsg has_any ("httpd", "apache2", "nginx", "php-fpm", "lsphp", "cpanel", "acronis")),
(CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceProduct has "auditd"
| where FileName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl", "nc", "su", "sudo", "useradd", "usermod")
| where Message has_any ("httpd", "apache2", "nginx", "php-fpm", "cpanel", "acronis"))
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by Computer, ProcessName, FileName, Message
| order by LastSeen desc
-- Velociraptor hunt: identify suspicious shells/utilities parented to web server or Acronis plugin processes
-- and enumerate recent persistence artifacts on Linux hosting servers
SELECT Pid, Ppid, Name, Exe, Cmdline, Username, CreateTime
FROM pslist()
WHERE (
Exe =~ '(?i)(bash|sh|dash|zsh|python|perl|nc|ncat|socat|su|sudo|useradd|usermod)$'
AND Cmdline =~ '(?i)(httpd|apache2|nginx|php-fpm|lsphp|cpanel|acronis)'
)
OR Cmdline =~ '(?i)acronis'
-- Companion artifact: recently modified persistence locations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
'/etc/sudoers.d/*',
'/etc/cron.d/*',
'/etc/systemd/system/*.service',
'/root/.ssh/authorized_keys',
'/home/*/.ssh/authorized_keys'
])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC
Remediation
#!/bin/bash
# Acronis cPanel/WHM/Plesk plugin LPE — verification and remediation aid
# Run as root on each hosting server
echo "=== [1] Identify installed Acronis plugin version ==="
rpm -qa 2>/dev/null | grep -i acronis || dpkg -l 2>/dev/null | grep -i acronis
ls -la /usr/local/cpanel/whostmgr/docroot/cgi/ 2>/dev/null | grep -i acronis
echo "=== [2] Check for Acronis plugin/agent processes and recent binary modification ==="
ps aux | grep -i [a]cronis
find / -iname '*acronis*' -mtime -14 -type f 2>/dev/null | head -50
echo "=== [3] Audit for post-exploitation persistence ==="
echo "--- sudoers.d (recent changes):"; ls -lat /etc/sudoers.d/ 2>/dev/null | head
echo "--- authorized_keys (recent changes):"; find /root/.ssh /home/*/.ssh -name authorized_keys -mtime -14 2>/dev/null
echo "--- cron.d (recent changes):"; ls -lat /etc/cron.d/ 2>/dev/null | head
echo "--- new systemd units:"; find /etc/systemd/system -name '*.service' -mtime -14 2>/dev/null
echo "--- unexpected root accounts:"; awk -F: '$3 == 0 {print $1}' /etc/passwd
echo "=== [4] Check local users created recently ==="
awk -F: '{print $1, $3}' /etc/passwd | while read u id; do
if [ "$id" -ge 1000 ] 2>/dev/null; then echo "$u (uid $id)"; fi
done
lastlog | grep -v "Never" | head -20
echo "=== [5] Update the Acronis plugin via the vendor's published fixed build ==="
echo "Follow the Acronis security advisory / update instructions for the cPanel-WHM-Plesk plugin."
echo "If the plugin is not required, consider removal until patched:"
echo " # /usr/local/acronis/uninstall (path varies by install) or remove via WHM plugin management"
echo "=== [6] Verify backups are intact and test restore ==="
echo "Attackers exploiting backup plugins frequently target backup integrity first."
Priority actions:
- Patch immediately. Apply the fixed Acronis plugin build per the official Acronis security advisory. Verify the installed version against the advisory's fixed-version statement on every cPanel/WHM/Plesk server — including reseller and staging boxes, which are routinely forgotten.
- If patching is delayed, reduce exposure. Temporarily disable or remove the Acronis plugin on internet-facing hosting servers, and restrict cPanel/WHM/Plesk administrative interfaces to allowlisted management IPs.
- Hunt before you trust. Because exploitation predates the disclosure, run the detections above across at least the last 14–30 days. Look specifically for new UID 0 accounts, modified sudoers, unexpected authorized_keys entries, and shells parented to web server or Acronis processes.
- Protect backup integrity. Verify backup job success and test a restore from a known-good point. Attackers who compromise backup tooling frequently corrupt or delete recovery points ahead of extortion or ransomware deployment.
- Rotate credentials after compromise indicators. If any post-exploitation artifacts are found, treat all credentials on the server — root, cPanel accounts, MySQL, API keys in tenant configs — as compromised.
- Monitor for KEV inclusion. Given confirmed in-the-wild exploitation, watch for CISA Known Exploited Vulnerabilities catalog entry and any associated federal remediation deadline; align your internal SLA accordingly.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.