Acronis Security Update Fixes Critical Vulnerability in cPanel Backup Plugin

Post Views: 3

Acronis has released urgent updates to address a critical vulnerability impacting the Backup plugin for cPanel & WHM, which has been actively exploited in targeted cyberattacks.

Acronis Addresses Exploited Flaw in cPanel Backup Plugin

Acronis has released urgent updates to address a critical vulnerability impacting the Backup plugin for cPanel & WHM, which has been actively exploited in targeted cyberattacks. The flaw, identified as CVE-2026-87886 with a CVSS score of 7.8, affects insecure file permissions within the backup tool and the Backup extension for Plesk. This issue enables threat actors to escalate privileges on affected systems.

Vulnerability Details

The vulnerability has been observed in limited, targeted attacks specifically targeting deployments of the Acronis Backup plugin for cPanel & WHM. However, no exploitation has been reported against the Plesk extension to date. Acronis confirmed that all Linux-based versions of the cPanel plugin prior to build 1.9.3.1021 and the Plesk extension prior to build 1.8.11.638 are at risk. The company has not disclosed specific technical details about the flaw but emphasized the urgency of applying the patches.

Impact and Response

Affected organizations are advised to update their installations immediately to mitigate potential compromise. The flaw’s exploitation highlights the risks associated with misconfigured permissions in backup solutions, which can serve as entry points for adversaries seeking to infiltrate hosting environments. The incident underscores the importance of timely patch management, particularly for critical infrastructure components like backup systems.

Broader Implications

Cybersecurity teams are urged to review their deployments and ensure compliance with the latest security updates. The vulnerability’s discovery follows a series of recent security disclosures, including exploits targeting other platforms such as Oracle, ConnectWise, and Cisco. These events reinforce the need for continuous monitoring and proactive defense strategies to counter evolving threats.

Organizations using the affected software should prioritize applying the patches and conducting thorough security assessments to identify any potential indicators of compromise. The incident also serves as a reminder of the broader challenges in securing complex IT ecosystems, where third-party tools and plugins can introduce significant risks if not properly maintained.