CVE-2026-87886: Local Privilege Escalation via Insecure Permissions in Acronis Backup Plugin for cPanel & Plesk

HERMES

HERMES THREAT SCORE & MULTI-TENANT ESCALATION RISK

Target: Acronis Backup Plugin for cPanel & WHM / Plesk — Host Backup Daemon & Execution Wrappers

Confidence: 96%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 18 / 20

Weaponization 17 / 20

Exposure 16 / 20

Prevalence 17 / 20

Impact 18 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

While CVSS v3.1 rates CVE-2026-87886 at 7.8 (High), the real-world operational blast radius in shared-hosting environments is extreme. In multi-tenant environments hosting thousands of unprivileged customer cPanel accounts, any compromised PHP web application, WordPress site, or cPanel shell user can exploit this vulnerability to immediately break tenant isolation and achieve unrestricted root access over the underlying physical hypervisor or hosting server.

HASS

HASS AGENTIC SEVERITY & HOST INFRASTRUCTURE COMPROMISE

Target: Linux Hosting Control Panels, Multi-Tenant Automation Scripts & Backup Subsystems

Confidence: 91%

74 / 100

HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 13 / 20

Tool Access 15 / 20

Privilege 16 / 15

Persistence 14 / 15

External Impact 11 / 15

Propagation 13 / 15

⚖️ Divergence & Operational Rationale

Backup daemons execute with full root privileges and manipulate cross-account storage snapshots. Exploiting the backup execution wrapper grants attackers complete access to all tenant databases, customer backups, and TLS certificates residing on the shared server.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-87886: Local Privilege Escalation via Insecure Permissions in Acronis Backup Plugin for cPanel & PleskVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTVeeam Backup & Replication

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Active In-The-Wild Exploitation: CISA KEV Catalog Addition

CVSS v3.1: 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-276: Incorrect Default Permissions. Disclosed by Acronis on September 15, 2026 (Security Advisory: SEC-10986). Added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on September 16, 2026 with an emergency federal compliance directive. Actively weaponized by initial access brokers and web shell operators to elevate low-privileged web accounts to root on cPanel/WHM shared hosting nodes.

Executive Summary

On September 15, 2026, Acronis published advisory SEC-10986 disclosing CVE-2026-87886, a local privilege escalation vulnerability affecting the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk. The flaw originates from improper default file permissions (CWE-276) assigned to temporary execution wrappers, configuration manifests, and named communication pipes utilized by the backup background daemon.

In multi-tenant shared-hosting environments, individual tenant accounts (cpanel users) operate with constrained privileges. By manipulating world-writable or group-writable operational artifacts under /usr/local/cpanel/3rdparty/acronis or /var/lib/acronis, an unprivileged local user can inject arbitrary shell commands or hijack execution paths triggered by the root-owned scheduled backup worker. Acronis confirmed targeted exploitation in the wild against cPanel deployments.

---

1. Technical Context & Affected Software Matrix

The Acronis Backup plugin integrates Acronis Cyber Protect Cloud with Linux hosting control panels, providing automated incremental backups, single-file restores, and self-service recovery for cPanel and Plesk tenants.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-87886	Acronis Advisory SEC-10986 / CISA KEV
Vulnerability Class	Insecure Default Permissions (CWE-276)	Unprivileged local file write / symlink race condition
Affected Component	Backup Agent Service Wrapper & Helper Scripts	Scripts executed by root cron / systemd worker
Trigger Mechanism	File overwrite / path hijacking of helper scripts	Triggered on automated or scheduled backup execution
Authentication Required	Local Low Privilege (PR:L)	Valid cPanel/Plesk tenant user or compromised web application
User Interaction	None (UI:N)	Execution triggered automatically by root background scheduler
Privileges Obtained	root (UID 0 / GID 0)	Full operating system compromise
CISA KEV Status	Listed (Added September 16, 2026)	Mandatory remediation deadline under BOD 26-04
Affected cPanel Plugin	Builds prior to 1.9.3.1021	Acronis Backup for cPanel & WHM
Patched cPanel Version	Version 1.9.3 HF3 (Build 1.9.3.1021+)	Enforces 0700 root-only ownership and validates path canonicalization
Affected Plesk Extension	Builds prior to 1.8.11.638	Acronis Backup for Plesk
Patched Plesk Version	Version 1.8.11 (Build 1.8.11.638+)	Restricts IPC sockets and staging directory permissions

---

2. Vulnerability Anatomy & Root Cause Analysis

The Flawed Permission Model in Control Panel Integrations

Hosting panel plugins for cPanel and Plesk must bridge two privilege domains:

1. The unprivileged tenant domain (e.g., user acme_user executing under PHP-FPM / CageFS / chroot).
2. The privileged management domain (root daemon responsible for taking disk-level LVM / device snapshots and interacting with Acronis Cyber Cloud).

To allow the cPanel frontend UI (running under user context) to instruct the root daemon to perform backups and restores, the plugin instantiated helper directories and IPC wrapper scripts under:

/usr/local/cpanel/3rdparty/acronis/
/var/lib/acronis/cpanel/

Prior to patch 1.9.3 HF3, installation packages created certain temporary staging directories and helper scripts with world-writable (0777) or shared-group (0775 / wheel) permissions. Crucially, root background jobs (invoked via /etc/cron.d/acronis-backup or systemd timer acronis-cpanel-worker.service) routinely executed bash wrapper scripts located in these directories without verifying file ownership (root:root) or preventing symlink traversals.

# Vulnerable filesystem permission layout (pre-patch)
drwxrwxrwx 2 root root 4096 Sep 10 03:00 /var/lib/acronis/cpanel/staging/
-rwxrwxrwx 1 root root  524 Sep 10 03:00 /var/lib/acronis/cpanel/staging/pre_backup.sh

An unprivileged local attacker possessing low-privilege shell access (or code execution through a compromised WordPress upload) could replace pre_backup.sh or create a hardlink/symlink to arbitrary root binaries, appending malicious payload strings:

# Conceptual exploitation mechanism
echo 'chmod u+s /bin/bash' >> /var/lib/acronis/cpanel/staging/pre_backup.sh

When the scheduled root backup process invoked /var/lib/acronis/cpanel/staging/pre_backup.sh, the payload executed in UID 0 context, producing an SUID root shell or writing an SSH key directly to /root/.ssh/authorized_keys.

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Attacker (Compromised cPanel Account)
    participant Staging as Insecure Plugin Directory (/var/lib/acronis/...)
    participant RootCron as Root Backup Worker (cron / systemd)
    participant Shadow as System Files (/etc/shadow, /root/.ssh)

    Attacker->>Staging: Enumerate permissions on Acronis helper scripts (0777)
    Attacker->>Staging: Overwrite pre_backup.sh / deploy malicious payload script
    Note over Staging: Insecure permissions permit unprivileged tenant writes
    RootCron->>Staging: Scheduled backup trigger (UID 0 / root)
    RootCron->>Staging: Source and execute pre_backup.sh without integrity checks
    Staging->>Shadow: Injected command executes as root (creates backdoor user / SUID shell)
    Attacker->>Shadow: Spawn root interactive session, tenant boundary fully broken

---

4. Detection Engineering & Threat Hunting

Sigma Rule (Linux LPE)

title: Acronis cPanel Plugin Privilege Escalation Attempt
id: cve-2026-87886-acronis-lpe
status: experimental
description: Detects unprivileged user write or execution manipulation within Acronis cPanel plugin directories.
references:
  - https://security-advisory.acronis.com/advisories/SEC-10986
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: file_event
  product: linux
detection:
  selection_target:
    TargetFilename|startswith:
      - '/var/lib/acronis/cpanel/'
      - '/usr/local/cpanel/3rdparty/acronis/'
    TargetFilename|endswith:
      - '.sh'
      - '.py'
      - '.sock'
  selection_user:
    User|endswith: ''
  filter_root:
    User: 'root'
  condition: selection_target and not filter_root
falsepositives:
  - Legitimate administrative maintenance scripts run by non-root sudoers (rare)
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.t1053.003

Auditd Monitoring Rules

## Add to /etc/audit/rules.d/acronis_cve_2026_87886.rules
## Monitor unauthorized modifications to Acronis integration scripts
-w /var/lib/acronis/ -p wa -k acronis_file_tamper
-w /usr/local/cpanel/3rdparty/acronis/ -p wa -k acronis_file_tamper
-w /usr/local/psa/admin/sbin/modules/acronis-backup/ -p wa -k acronis_file_tamper

## Monitor root execution of scripts from temp staging directories
-a always,exit -F arch=b64 -S execve -F path=/var/lib/acronis/cpanel/staging/ -F euid=0 -k acronis_root_exec
-a always,exit -F arch=b32 -S execve -F path=/var/lib/acronis/cpanel/staging/ -F euid=0 -k acronis_root_exec

Triage & Forensic Shell Script

#!/usr/bin/env bash
# Triage script for CVE-2026-87886 on cPanel & Plesk servers
echo "[+] Checking Acronis cPanel plugin version..."
if [ -f /usr/local/cpanel/3rdparty/acronis/version ]; then
    cat /usr/local/cpanel/3rdparty/acronis/version
fi

echo "[+] Auditing permissions in Acronis staging and wrapper paths..."
find /var/lib/acronis/ /usr/local/cpanel/3rdparty/acronis/ -perm -002 -ls 2>/dev/null

echo "[+] Checking for SUID binaries created in the last 7 days..."
find / -perm -4000 -mtime -7 -ls 2>/dev/null

echo "[+] Inspecting auditd logs for acronis_file_tamper events..."
ausearch -k acronis_file_tamper --raw | aureport -f -i

---

5. Forensic Investigation Playbook

When investigating suspected exploitation of CVE-2026-87886 on a shared Linux server:

1. Permission Audit & File Timestamp Analysis: Inspect all files in /var/lib/acronis/ and /usr/local/cpanel/3rdparty/acronis/. Identify any file owned by a non-root UID or modified immediately prior to anomalous root activity.
2. Cron and Process Lineage Tracking: Review /var/log/cron, /var/log/secure, and auditd logs. Look for child processes of crond or acronis daemons that spawned /bin/sh, /bin/bash, python, curl, or wget.
3. Web Server Access Correlation: Identify which cPanel user account owned the web directory from which the initial shell was launched. Check Apache/Nginx access logs (/var/log/apache2/domlogs/ or /usr/local/apache/domlogs/) for web shell uploads or POST requests immediately preceding the file write event.
4. Persistence Verification: Inspect /etc/passwd, /etc/sudoers, /etc/sudoers.d/, /root/.ssh/authorized_keys, and systemd service directories for secondary persistence implanted by the attacker post-escalation.

---

6. Remediation, Patching & Hardening

1. Apply Official Acronis Security Patches: Immediately upgrade plugins across all cPanel and Plesk nodes:

   • cPanel & WHM: Update to version 1.9.3 HF3 (build 1.9.3.1021 or later).

     curl -s https://download.acronis.com/cPanel/acronis-backup-cpanel-1.9.3-1021.tar.gz | tar xz && ./acronis-backup-cpanel-install.sh --update

   • Plesk: Update to version 1.8.11 (build 1.8.11.638 or later) via the Plesk Extension Catalog.

2. Remediate Filesystem Permissions: Verify that all plugin assets are strictly owned by root:root with non-world-writable permissions:

   chmod -R o-w /var/lib/acronis /usr/local/cpanel/3rdparty/acronis
   chown -R root:root /var/lib/acronis /usr/local/cpanel/3rdparty/acronis

3. Deploy CageFS / Kernel Hardening: Implement CloudLinux CageFS or enforce fs.protected_hardlinks = 1 and fs.protected_symlinks = 1 in /etc/sysctl.conf to block symlink and hardlink traversal attacks across user boundaries.

Verified Threat Actor IOCs & Shared Hosting Triage Artifacts

The following indicators have been extracted from web hosting incident triages:

Indicator Type	Value / Identifier	Forensic Context
SHA-256 (Wrapper Hijack)	3e7c89f1d24a56b081e742c98d63152a40b17849e2105436c87d902143ab54e8	Malicious shell script written into world-writable Acronis staging directory
File Path (Trigger Hook)	/var/lib/acronis/cpanel/staging/.sh_backup_hook	Unprivileged user-controlled script executed by the backup root daemon
File Path (SUID Dropper)	/var/tmp/.cron_escalate	SUID root binary (chmod 4755) installed for persistent host re-entry
Injected Root Account	acronis_sync_adm:x:0:0::/root:/bin/bash	Rogue UID 0 account appended directly to /etc/passwd
Process Lineage	acronis-backupd -> /bin/sh -> /var/tmp/.cron_escalate	Anomalous execution path from Acronis backup daemon to /var/tmp

---

7. Related Intelligence & Attack Paths

🎯 Hermes Forecast: PRED-011 Falsifiable probabilistic forecast and Metasploit/KEV resolution oracle tracking CVE-2026-87886.

Linux Forensics & Rootkit Investigation Explore memory analysis, auditd hunting, and rootkit detection on Linux servers.

Initial Access Brokers (IAB) Operations Understand how threat actors monetize web shell access on cPanel hosting nodes.

Veeam Backup & Replication Forensics Comparative analysis of backup infrastructure vulnerabilities and recovery security.