On September 16, 2026, CISA added CVE-2026-87886 to the Known Exploited Vulnerabilities (KEV) catalog — the agency's unambiguous signal that this flaw is being actively exploited in the wild, not merely theorized about in a lab. The vulnerability is an incorrect default permissions weakness (CWE-732) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. Successful exploitation allows unauthorized privilege gain on affected hosting servers.
If you operate shared hosting infrastructure, managed VPS fleets, or any server where the Acronis Backup plugin is installed alongside cPanel/WHM or Plesk, treat this as an emergency change, not a routine patch cycle. Incorrect-permissions flaws in hosting-panel plugins are disproportionately dangerous: they typically expose privileged helper scripts, backup credentials, or setuid-capable components to every local account on the box — including the low-privileged web service users that attackers already control through compromised WordPress sites and webshells. In a shared-hosting context, this is the difference between one defaced site and full root compromise of the entire node.
Under Binding Operational Directive (BOD) 26-04, federal civilian agencies are required to apply vendor mitigations and align with CISA's Forensics Triage Requirements. Private-sector defenders should treat the KEV listing with the same urgency.
Technical Analysis
Affected Products
- Acronis Backup plugin for cPanel & WHM — typically deployed under the WHM docroot CGI path (e.g.,
/usr/local/cpanel/whostmgr/docroot/cgi/acronis/and related cPanel integration directories) - Acronis Backup extension for Plesk — deployed under Plesk's extension tree (e.g.,
/usr/local/psa/admin/htdocs/modules/and associated/opt/acronis/or/usr/lib/plesk-9.0/integration paths depending on version)
Both integrations run with elevated context because backup operations inherently require reading arbitrary user data — meaning the plugin components are precisely the kind of target where a permissions misconfiguration converts directly into privilege escalation.
How the Vulnerability Works
Incorrect default permissions (CWE-732) means files or directories installed by the plugin ship with access controls that are too permissive — world-writable scripts, readable credential stores, or executable helpers owned by a privileged account but modifiable by unprivileged users. The exploitation chain in hosting environments is well-established and, per the KEV listing, is what attackers are doing now:
- Initial foothold (pre-existing): Attackers gain code execution as a low-privileged user on the hosting node — most commonly via a compromised CMS site (webshell under a customer account) or a vulnerable web application. On cPanel/Plesk boxes this means running as a customer UID,
nobody,apache, orwww-data. - Discovery: The attacker enumerates the filesystem for misconfigured privileged components — world-writable files under Acronis plugin paths, overly permissive setuid/setgid binaries, or readable backup configuration files containing credentials.
- Privilege escalation: Depending on the misconfiguration, the attacker either modifies a privileged-executed script (which then runs their payload as root on the next backup job or panel invocation), reads credentials/secrets that grant administrative access, or abuses a permissive helper binary directly.
- Post-exploitation: Root-level persistence on the hosting node — cron backdoors, modified authentication hooks, credential harvesting across all hosted accounts, and frequently ransomware staging or mass defacement.
This class of bug requires no network exposure of the plugin itself — it is a local privilege escalation. That makes it the perfect second stage for the mass web-compromise campaigns that constantly sweep hosting infrastructure. CISA KEV inclusion confirms threat actors have weaponized exactly this chain.
Exploitation Status
- CISA KEV: Added 2026-09-16 — confirmed active exploitation in the wild
- Required action (per KEV/BOD 26-04): Apply vendor mitigations; follow BOD 26-04 guidance for cloud services; evaluate internet exposure of each asset; discontinue use of the product if mitigations are unavailable
- CVSS: Awaiting vendor/NVD scoring at time of publication — treat as critical priority given KEV status and privilege-gain impact on multi-tenant infrastructure
Detection & Response
The highest-fidelity detection opportunities are behavioral: low-privileged web service accounts doing things they never legitimately do (spawning shells, modifying files under Acronis plugin paths, creating setuid binaries), and post-exploitation persistence. Deploy the rules below across your Linux hosting fleet — cPanel/Plesk servers should be shipping auditd/process telemetry and Syslog to your SIEM.
Sigma Rules
---
title: Web Service User Spawning Interactive Shell (Hosting Server Privilege Escalation)
id: 2b7c4f91-8a3e-4d62-bf15-9c1e2a7d8304
status: experimental
description: Detects low-privileged web service or hosting panel service accounts spawning interactive shells, a common indicator of webshell-based post-exploitation preceding local privilege escalation such as CVE-2026-87886 abuse on cPanel/Plesk hosts.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/09/17
tags:
- attack.execution
- attack.privilege_escalation
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_user:
User:
- 'nobody'
- 'apache'
- 'www-data'
- 'nginx'
- 'psaadm'
- 'cpanel'
selection_shell:
Image|endswith:
- '/bash'
- '/sh'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/socat'
- '/nc'
- '/ncat'
condition: selection_user and selection_shell
falsepositives:
- Legitimate cron jobs or panel maintenance tasks running as service accounts (validate against change windows)
level: high
---
title: Modification of Acronis Backup Plugin Files by Non-Root User
id: 5d1e8a36-2f94-4c7b-ae63-8b0d4c9f2157
status: experimental
description: Detects file modification, permission changes, or ownership changes under Acronis Backup plugin directories for cPanel/WHM or Plesk performed by unprivileged accounts, consistent with exploitation of an incorrect default permissions vulnerability (CVE-2026-87886).
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886
- https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/09/17
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1222
logsource:
category: process_creation
product: linux
detection:
selection_cmds:
Image|endswith:
- '/chmod'
- '/chown'
- '/tee'
- '/cp'
- '/mv'
- '/sed'
selection_paths:
CommandLine|contains:
- '/acronis'
- 'whostmgr/docroot/cgi'
- '/psa/admin/htdocs/modules'
filter_root:
User: 'root'
condition: selection_cmds and selection_paths and not filter_root
falsepositives:
- Acronis support or administrator maintenance performed under a non-root sudo session (audit sudoers activity)
level: critical
---
title: Suspicious Setuid Binary Creation on Linux Hosting Server
id: 91c3b7e4-6d28-4a51-9f07-3e6b2d48c019
status: experimental
description: Detects creation of setuid/setgid binaries outside of package management, a common post-exploitation persistence step following local privilege escalation on hosting servers.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886
- https://attack.mitre.org/techniques/T1548.001/
author: Security Arsenal
date: 2026/09/17
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1548.001
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: '/chmod'
CommandLine|contains:
- 'u+s'
- 'g+s'
- '4755'
- '4750'
- '6777'
- '6755'
filter_pkg:
ParentImage|endswith:
- '/dpkg'
- '/rpm'
- '/yum'
- '/dnf'
- '/apt'
- '/apt-get'
condition: selection and not filter_pkg
falsepositives:
- Rare legitimate setuid configuration by system administrators during software installs
level: high
KQL — Microsoft Sentinel (via Syslog/CEF ingestion from Linux hosts)
The following hunt pivots on the exploitation pattern: service-account shell execution and Acronis path manipulation, joined to surface hosts exhibiting both behaviors in a short window. It assumes cPanel/Plesk servers forward Syslog (auth, auditd execve) into Sentinel.
let lookback = 7d;
let acronisPaths = dynamic(["acronis", "whostmgr/docroot/cgi", "psa/admin/htdocs/modules"]);
let serviceAccounts = dynamic(["nobody", "apache", "www-data", "nginx", "psaadm", "cpanel"]);
let shellExec = Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl", "nc", "ncat", "socat")
| where SyslogMessage has_any (serviceAccounts)
| project ShellTime=TimeGenerated, Computer, ProcessName, SyslogMessage;
let permAbuse = Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName in~ ("chmod", "chown", "cp", "mv", "tee", "sed", "install")
| where SyslogMessage has_any (acronisPaths)
| project PermTime=TimeGenerated, Computer, ProcessName, SyslogMessage;
shellExec
| join kind=inner permAbuse on Computer
| extend TimeDelta = abs(datetime_diff('minute', ShellTime, PermTime))
| where TimeDelta <= 60
| project Computer, ShellTime, ProcessName, SyslogMessage, PermTime, ProcessName1, SyslogMessage1, TimeDelta
| sort by Computer, ShellTime desc
For Defender for Endpoint-on-Linux coverage, supplement with DeviceProcessEvents hunting the same parent/child anomalies, and run a permission-audit hunt for setuid artifacts:
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("chmod", "chown")
| where ProcessCommandLine has_any ("u+s", "g+s", "4755", "4750", "6777")
| where InitiatingProcessFileName !in~ ("dpkg", "rpm", "yum", "dnf", "apt", "apt-get")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated desc
Velociraptor VQL — Endpoint Forensic Hunt
Deploy this hunt across hosting servers to identify misconfigured permissions on Acronis plugin paths (the vulnerable condition itself) alongside suspicious process execution from service accounts.
-- CVE-2026-87886 triage: world-writable or group-writable files under Acronis plugin paths
LET plugin_paths = ["/usr/local/cpanel/whostmgr/docroot/cgi/acronis/**",
"/opt/acronis/**",
"/usr/local/psa/admin/htdocs/modules/**acronis**/**"]
SELECT FullPath, Mode, Uid, Gid, Mtime, Size
FROM glob(globs=plugin_paths)
WHERE Mode.IsWrite
AND FullPath !~ '\\.log$'
-- Correlate: shells or interpreters running as web service accounts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ '^(nobody|apache|www-data|nginx|psaadm|cpanel)$'
AND Name =~ '(?i)(bash|sh|dash|zsh|python|perl|nc|ncat|socat|php)'
-- Identify recently created setuid/setgid artifacts post-compromise
SELECT FullPath, Mode.String AS Mode, Uid, Gid, Mtime, Ctime
FROM glob(globs=["/usr/local/cpanel/**", "/opt/**", "/tmp/**", "/var/tmp/**", "/dev/shm/**"])
WHERE Mode.String =~ 's'
AND Ctime > timestamp(epoch=1789689600) -- 2026-09-17 00:00:00 UTC
Remediation & Verification Script
Run this Bash script across your cPanel/WHM and Plesk fleet (via Ansible, Salt, or your RMM) to confirm whether the vulnerable plugin is present, audit for the misconfigured-permissions condition, flag indicators of compromise, and verify remediation after vendor updates are applied.
#!/bin/bash
# CVE-2026-87886 triage & verification - Acronis Backup plugin for cPanel/WHM and Plesk
# Run as root. Review output before taking destructive action.
echo "=== [1] Acronis plugin presence check ==="
CPANEL_PLUGIN=$(find /usr/local/cpanel /opt/acronis -iname '*acronis*' 2>/dev/null | head -20)
PLESK_PLUGIN=$(plesk bin extension --list 2>/dev/null | grep -i acronis)
echo "cPanel/WHM artifacts: ${CPANEL_PLUGIN:-none found}"
echo "Plesk extension: ${PLESK_PLUGIN:-none found}"
if [ -z "$CPANEL_PLUGIN" ] && [ -z "$PLESK_PLUGIN" ]; then
echo "[OK] No Acronis plugin artifacts detected. Host not affected."
exit 0
fi
echo ""
echo "=== [2] World/group-writable files under Acronis paths (vulnerable condition) ==="
find /usr/local/cpanel /opt/acronis /usr/local/psa/admin/htdocs/modules \
-path '*acronis*' \( -perm -0002 -o -perm -0020 \) -type f \
-exec ls -la {} \; 2>/dev/null
echo ""
echo "=== [3] Unexpected setuid/setgid binaries under plugin paths ==="
find /usr/local/cpanel /opt/acronis -path '*acronis*' \( -perm -4000 -o -perm -2000 \) \
-exec ls -la {} \; 2>/dev/null
echo ""
echo "=== [4] IoC sweep: recent file modifications under plugin paths (last 14 days) ==="
find /usr/local/cpanel /opt/acronis /usr/local/psa/admin/htdocs/modules \
-path '*acronis*' -type f -mtime -14 -exec ls -la {} \; 2>/dev/null
echo ""
echo "=== [5] IoC sweep: suspicious files in writable temp locations ==="
find /tmp /var/tmp /dev/shm -type f \( -perm -4000 -o -name '*.php' -o -name '*.pl' \) \
-mtime -14 -exec ls -la {} \; 2>/dev/null
echo ""
echo "=== [6] Cron persistence check (root and service accounts) ==="
crontab -l 2>/dev/null | grep -Ev '^\s*#' | grep -iE 'curl|wget|/tmp|/dev/shm|base64'
for u in nobody apache www-data nginx cpanel; do
crontab -u "$u" -l 2>/dev/null | grep -Ev '^\s*#' | grep . && echo " ^^ user: $u"
done
ls -la /etc/cron.d/ 2>/dev/null
echo ""
echo "=== [7] Recent privilege escalation evidence in auth logs ==="
grep -E 'sudo|su:' /var/log/secure /var/log/auth.log 2>/dev/null | \
grep -E 'nobody|apache|www-data|nginx|psaadm' | tail -20
echo ""
echo "=== [8] Remediation: update plugin via panel package manager ==="
echo "cPanel/WHM: update via WHM > Manage Plugins or per Acronis advisory instructions."
echo "Plesk: run 'plesk bin extension --upgrade acronis-backup' or update via Plesk UI."
echo "After update, RE-RUN sections [2] and [3] - writable/setuid findings must be empty."
echo "If vendor mitigation is unavailable: REMOVE the plugin (KEV mandate: discontinue use)."
Remediation
Priority: Emergency. This is a CISA KEV-listed vulnerability with confirmed active exploitation.
- Inventory immediately. Identify every server in your environment running the Acronis Backup plugin for cPanel & WHM or the Acronis extension for Plesk. In hosting environments this is frequently deployed by default or by upstream provisioning templates — do not assume you know where it lives.
- Apply vendor mitigations. Follow the Acronis security advisory for CVE-2026-87886 precisely: update the plugin/extension through WHM's plugin management or
plesk bin extension --upgrade, then apply any vendor-specified permission corrections. After updating, re-run the permission audit (script sections 2-3 above) — an update that leaves stale world-writable files behind has not closed the hole. - Meet the KEV/BOD 26-04 requirements. Federal agencies must remediate within the KEV-specified due date, apply CISA's Forensics Triage Requirements to potentially affected assets, and evaluate each asset's internet exposure. If no mitigation is available for your deployment, CISA's directive is explicit: discontinue use of the product. Private organizations should adopt the same posture.
- Hunt before you patch. Because exploitation is confirmed active, assume compromise is possible on any host where the vulnerable permissions existed. Run the Sigma/KQL/VQL detections above against at least 30 days of retained telemetry. Pay special attention to hosts with prior webshell or CMS compromise — those are the attacker's entry ramp to this local escalation.
- Forensic triage on any positive hit. If detection surfaces service-account shell execution or unauthorized modification of Acronis plugin paths, isolate the host, capture memory and disk artifacts per your IR runbook (and per CISA's Forensics Triage Requirements for covered entities), and audit all hosted customer accounts for downstream compromise — a root-level intrusion on a shared node exposes every tenant.
- Harden the hosting baseline going forward. Enforce CIS Benchmark guidance for Linux hosting servers: periodic world-writable/setuid audits as automated compliance checks, restricted service-account shells (
/sbin/nologinwhere operationally feasible), mandatory telemetry forwarding from all panel servers to the SIEM, and EDR coverage on Linux nodes — not just Windows endpoints.
The uncomfortable truth with hosting-panel vulnerabilities is that the blast radius is multiplicative. One local privilege escalation on a shared node is a breach of every tenant on that node. If your organization resells or operates hosting, this KEV entry is a same-day action item.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.