CVE-2026-87886: Acronis hosting panel plugins allow root escalation

CVE-2026-87886 (CVSS 7.8) is a local privilege escalation caused by insecure file permissions in Acronis Backup plugins for cPanel/WHM before build 1.9.3.1021, Plesk before 1.8.11.638 and DirectAdmin before 1.2.3.238. CISA added it to the Known Exploited Vulnerabilities catalog on 16 September 2026; root access on shared hosting exposes every account and backup credentials.

• CVSS 3.0 base score 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Affected builds: cPanel before 1.9.3.1021, Plesk before 1.8.11.638, DirectAdmin before 1.2.3.238
• CISA added the CVE to its exploited catalog on 16 September 2026
• Acronis tracks the flaw as SEC-10986