Actively exploited in the wild
Acronis Backup Incorrect Default Permissions Vulnerability
Acronis - Backup · Listed in the CISA KEV since 2026-09-16. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-87886
HighCVSS 7.8KEVSummary
Local privilege escalation due to insecure file permissions. Affects Acronis Backup plugins for cPanel & WHM, Plesk, and DirectAdmin in versions older than the specified builds.
Risk Assessment
A low-privileged local user can escalate to higher privileges, potentially leading to full system compromise and exposure of backup data.
Recommendation
Update Acronis Backup plugins to at least build 1.9.3.1021 (cPanel & WHM), 1.8.11.638 (Plesk), and 1.2.4.238 (DirectAdmin).
Related vulnerabilities
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-76949Critical
A vulnerability in the ash_authentication library (Elixir) allows an attacker who can plant a remember-me cookie in a victim's browser to replace the victim's authenticated session with one for the attacker's own account. The issue stems from a mismatch between the session keys used by the guard and the reader, causing remember-me sign-in to run on every request.
Original NVD description (English source)
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.4.238.