CVE-2026-87886 is a high-severity vulnerability (CVSS 7.8), listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited.
Summary
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
Remediation
It is actively exploited — apply the vendor’s patch immediately and prioritize internet-facing systems. Patch-management tools that can deploy and verify the fix include Action1, Automox, ManageEngine Patch Manager Plus, ManageEngine Endpoint Central. See our best patch management ranking.