CVE-2026-87886 in Backup Plugin
Summary
by MITRE • 09/18/2026
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The identified vulnerability represents a critical local privilege escalation flaw rooted in insecure file permissions within the backup infrastructure components of several popular web hosting control panels. Specifically, this issue affects Acronis Backup plugin for cPanel & WHM prior to build 1.9.3.1021, the Acronis Backup extension for Plesk before build 1.8.11.638, and the Acronis Backup plugin for DirectAdmin before build 1.2.3.238 on Linux operating systems. The core technical flaw lies in the improper configuration of file system access controls during installation or runtime operations. When these plugins create temporary files, log entries, or backup archives, they fail to enforce restrictive permissions that limit access solely to the privileged user account running the service. Instead, the affected files are often created with world-readable and writable permissions, such as 0644 or worse, allowing any local user on the system to read sensitive data or modify critical configuration files associated with the backup process.
This misconfiguration creates a significant attack surface for lateral movement within a compromised server environment. An attacker who has gained low-level access through other vectors, such as exploiting a web application vulnerability in a hosted website or gaining shell access via an insecure SSH key, can leverage these poorly secured files to escalate privileges to the root level. By modifying specific configuration files or injecting malicious scripts into world-writable directories managed by the Acronis service, the attacker can force the backup daemon, which typically runs with elevated system privileges, to execute arbitrary code during its scheduled operations. This mechanism aligns closely with CWE-732, which describes improper permission assignment for critical resources, and is a common precursor to privilege escalation attacks documented in MITRE ATT&CK technique T1068, specifically under the sub-technique of exploitation for privilege escalation via insecure permissions or misconfigurations.
The operational impact of this vulnerability extends beyond simple data theft, although that remains a severe risk. Because backup software often handles sensitive credentials, database dumps, and full system states, unauthorized access to these files can lead to comprehensive data exfiltration. Furthermore, the ability to manipulate the backup process allows an attacker to disrupt business continuity by corrupting restore points or injecting malware into future backups, ensuring persistence even if the initial entry point is patched. In multi-tenant hosting environments typical of cPanel and Plesk deployments, this vulnerability enables a cross-account attack where one customer can compromise not only their own account but potentially other accounts on the same server that rely on shared system resources or are affected by the global nature of the backup service's file permissions.
Mitigation requires immediate action to address both the software versioning and the underlying permission configurations. Administrators must upgrade all affected Acronis Backup components to versions 1.9.3.1021 for cPanel, 1.8.11.638 for Plesk, or 1.2.3.238 for DirectAdmin, as these builds contain the necessary patches to enforce correct file ownership and permission settings upon creation of temporary and persistent files. In addition to upgrading software, system administrators should conduct a thorough audit of all directories used by backup services to ensure that no world-writable or group-readable sensitive files exist outside of standard secure configurations. Implementing strict adherence to the principle of least privilege is essential; this includes ensuring that backup processes run under dedicated service accounts with minimal required permissions and utilizing automated file integrity monitoring tools such as AIDE or Tripwire to detect unauthorized changes to critical system files in real time.