CVE-2026-87886: Acronis Backup Plugin for cPanel/WHM Local Privilege Escalation Exploited in the Wild — Detection and Remediation Guide

---
title: Non-Root Write to Acronis cPanel Backup Plugin Files
id: 3f9c1a72-8b4d-4e5a-9c61-7d2e5f8a3b41
status: experimental
description: Detects non-root users modifying or creating files within Acronis Backup plugin directories for cPanel/WHM. A core exploitation step of CVE-2026-87886, where insecure permissions allow a low-privileged user to tamper with files later executed as root.
references:
  - https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
  - https://attack.mitre.org/techniques/T1068/
  - https://attack.mitre.org/techniques/T1574/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.persistence
  - attack.t1574
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup'
      - '/usr/local/cpanel/3rdparty/'
      - '/var/lib/acronisbackup'
      - '/usr/local/cpanel/base/3rdparty/acronis'
  filter_root:
    User: 'root'
  filter_cpanel_service:
    User:
      - 'cpanel'
      - 'acronis'
  condition: selection_paths and not 1 of filter_*
falsepositives:
  - Plugin updates executed by WHM/cPanel update routines under non-root service accounts
  - Legitimate Acronis support operations
level: high
---
title: Permission Modification on Acronis Backup Plugin Paths
id: 8e2b5d14-6a3f-4c7b-b8e2-1f4a9d6c5e37
status: experimental
description: Detects chmod/chown execution targeting Acronis Backup plugin directories, including SUID/SGID bit setting and world-writable permission changes associated with CVE-2026-87886 exploitation and post-exploitation hardening removal.
references:
  - https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
  - https://attack.mitre.org/techniques/T1222/
  - https://attack.mitre.org/techniques/T1548.001/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.defense_evasion
  - attack.t1222.002
  - attack.privilege_escalation
  - attack.t1548.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/chmod'
      - '/chown'
      - '/chattr'
      - '/install'
  selection_paths:
    CommandLine|contains:
      - 'acronisbackup'
      - '/var/lib/acronis'
      - 'whostmgr/docroot/cgi'
  condition: selection_tools and selection_paths
falsepositives:
  - Acronis plugin installer or updater execution (correlate with maintenance windows)
  - Administrator remediation activity
level: medium
---
title: Suspicious Child Process from Acronis Backup or Cron Execution Context
id: 5c7a9e31-2d8f-4b6a-a3e9-8f1c4b7d2e96
status: experimental
description: Detects shells or system utility execution spawned by Acronis backup scripts or cron jobs referencing Acronis plugin paths. Indicates successful payload injection into a root-executed plugin component per CVE-2026-87886.
references:
  - https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/26
tags:
  - attack.execution
  - attack.t1059.004
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'acronisbackup'
      - '/var/lib/acronis'
      - 'acronis'
  selection_children:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/useradd'
      - '/usermod'
  filter_backup_tools:
    Image|endswith:
      - '/gzip'
      - '/tar'
      - '/rsync'
  condition: selection_parent and selection_children and not filter_backup_tools
falsepositives:
  - Custom pre/post backup hooks legitimately configured by the hosting provider — inventory these explicitly
level: critical

// Hunt for privilege escalation indicators around Acronis Backup plugin on cPanel/WHM hosts
// Covers: permission changes on plugin paths, non-root modification, suspicious child processes
let PluginPaths = dynamic(["acronisbackup", "/var/lib/acronis", "whostmgr/docroot/cgi/acronis"]);
union Syslog, CommonSecurityLog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("chmod", "chown", "chattr", "bash", "sh", "dash", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "useradd", "usermod")
   or Message has_any (PluginPaths)
| extend MessageText = tostring(coalesce(Message, AdditionalExtensions))
| where MessageText has_any (PluginPaths)
| extend SuspiciousPermChange = MessageText has_any ("chmod 777", "chmod 4777", "chmod 4755", "chmod u+s", "chmod 666", "+s ")
| extend NonRootWrite = (MessageText has_any ("openat", "write", "rename", "unlink") and MessageText !has "uid=0")
| where SuspiciousPermChange or NonRootWrite or ProcessName in~ ("chmod", "chown", "chattr", "useradd", "usermod")
| project TimeGenerated, Computer, ProcessName, MessageText, SuspiciousPermChange, NonRootWrite
| order by TimeGenerated desc;
// Secondary hunt: SUID/SGID binaries created on cPanel hosts in the last 14 days
Syslog
| where TimeGenerated > ago(14d)
| where Message has "chmod" and Message has_any ("4755", "4777", "u+s", "6755")
| project TimeGenerated, Computer, ProcessName, Message
| order by TimeGenerated desc;

-- Hunt for insecure permissions and tampering indicators on Acronis cPanel Backup plugin files
-- Artifacts: world-writable files in plugin paths, SUID/SGID binaries, recently modified scripts
SELECT FullPath, Mode.String AS Permissions, Mtime, Atime, Size,
       hash(path=FullPath) AS FileHash
FROM glob(globs=[
  '/usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup/**',
  '/usr/local/cpanel/3rdparty/**/acronis*/**',
  '/var/lib/acronisbackup/**'
])
WHERE Mode.String =~ 'w' AND (
      Mode.String =~ '^......w.'      -- world-writable
   OR Mode.String =~ '^...s'          -- SUID
   OR Mode.String =~ '^......s'       -- SGID
   OR Mtime > ago(168h)               -- modified in last 7 days
)
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-87886 - Acronis cPanel/WHM Backup Plugin audit & hardening
# Run as root on each cPanel/WHM host. Review output before making changes.

echo "=== [1] Identify Acronis plugin version ==="
if [ -f /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup/version ]; then
  cat /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup/version
fi
rpm -qa 2>/dev/null | grep -i acronis
dpkg -l 2>/dev/null | grep -i acronis

echo "=== [2] Find world-writable / SUID files in plugin paths (CVE-2026-87886 indicators) ==="
for DIR in /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup /usr/local/cpanel/3rdparty /var/lib/acronisbackup; do
  [ -d "$DIR" ] && find "$DIR" \( -perm -0002 -o -perm -4000 -o -perm -2000 \) -ls 2>/dev/null
done

echo "=== [3] Files modified in plugin paths in the last 14 days ==="
for DIR in /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup /var/lib/acronisbackup; do
  [ -d "$DIR" ] && find "$DIR" -type f -mtime -14 -ls 2>/dev/null
done

echo "=== [4] Recent privilege escalation attempts in auth logs ==="
grep -iE "acronis|acronisbackup" /var/log/secure /var/log/auth.log 2>/dev/null | tail -50
grep -iE "sudo.*(chmod|chown).*(acronis|acronisbackup)" /var/log/secure /var/log/auth.log 2>/dev/null

echo "=== [5] Rogue local users / SUID shells (post-exploitation check) ==="
awk -F: '($3 == 0) {print}' /etc/passwd
find / -xdev -type f -perm -4000 -mtime -14 -ls 2>/dev/null

echo "=== [6] Update the Acronis plugin via WHM or vendor updater ==="
# Preferred: WHM > Plugins > Acronis Backup > Update, or:
# /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup/update.sh  (if provided by vendor)
# Then re-run step [2] to verify permissions are corrected post-update.

echo "=== [7] Deploy auditd watch rules on plugin directories ==="
for DIR in /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup /var/lib/acronisbackup; do
  if [ -d "$DIR" ]; then
    auditctl -w "$DIR" -p wa -k acronis_plugin_tamper
    echo "-w $DIR -p wa -k acronis_plugin_tamper" >> /etc/audit/rules.d/acronis-cve-2026-87886.rules
  fi
done
augenrules --load 2>/dev/null && systemctl restart auditd 2>/dev/null

echo "=== [8] Temporarily restrict plugin execution pending patch (workaround) ==="
# If patching is not immediately possible, tighten permissions manually:
# find /usr/local/cpanel/whostmgr/docroot/cgi/acronisbackup -type f -perm -0002 -exec chmod o-w {} \;
# Consider suspending scheduled backup jobs until patched - weigh against backup availability risk.
echo "Done. Escalate any hits from steps 2, 3, or 5 to IR immediately."