Acronis Backup plugin flaw exploited in the wild on cPanel and Plesk

🕵️ RESEARCH & DEEP DIVES

• Acronis Backup plugin flaw CVE-2026-87886 exploited in the wild on cPanel and Plesk
  Acronis has patched a high-severity local privilege-escalation flaw in its cPanel and Plesk backup plugins after detecting limited targeted exploitation.

  • Affects Acronis Backup plugin for cPanel & WHM and Backup extension for Plesk on Linux hosting servers; relevant to hosting providers and MSPs.
  • CVE-2026-87886 (CWE-276, CVSS 7.8) stems from insecure default file permissions in Linux-based Acronis backup components.
  • Exploitation requires local access with low privileges and no user interaction, enabling elevation and potential access to backup data, system files, and other customer accounts.
  • Fixed in Acronis Backup plugin for cPanel & WHM version 1.9.3 HF3 and Backup extension for Plesk version 1.8.11; exploitation observed in limited, targeted attacks.
  Sources 📄 Source: security-advisory.acronis.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• Windows Server 2022 reaches end of mainstream support next month — BleepingComputer

• Enterprises Warned of Attacks Exploiting WSO2 Vulnerability — SecurityWeek

• Oracle Patches 800+ Vulnerabilities in September 2026 Security Update — SecurityWeek

• Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate dat... — CVE ThreatInt

• Apache Airflow FAB provider: FAB password reset never invalidates sessions: s... — CVE ThreatInt

• Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard ... — CVE ThreatInt

• fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 tra... — CVE ThreatInt

• ksmbd: prevent out-of-bounds reads in share config responsesIn the Linux kern... — CVE ThreatInt

• perf: Fix use-after-free when perf mmap() revival races with the last munmap(... — CVE ThreatInt

• ipv6: avoid divide by zero in rt6_multipath_rebalanceIn the Linux kernel, the... — CVE ThreatInt

• gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-f... — CVE ThreatInt

• ksmbd: fix tree connection use-after-free in smb2_tree_connect()In the Linux ... — CVE ThreatInt

• ext4: check dir entry fits before reading the hash trailer in ext4_search_dir... — CVE ThreatInt

• ext4: fix out-of-bounds read in ext4_read_inline_dir()In the Linux kernel, th... — CVE ThreatInt

• fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid initIn the Li... — CVE ThreatInt

• SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6In th... — CVE ThreatInt

• xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is fullIn t... — CVE ThreatInt

• fs/ntfs3: reject restart table growth beyond U16_MAX entriesIn the Linux kern... — CVE ThreatInt

• fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()In the Linux kernel, th... — CVE ThreatInt

• net: qualcomm: rmnet: restore skb->dev on deaggregated framesIn the Linux ker... — CVE ThreatInt

• Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root — Cyber Security News

• Iranian Hackers Use Fake MRI Results to Infect Victims With CHOSEN BRICK Spyware — Cyber Security News

• KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension — Cyber Security News

• Public PoC Released for Apache Superset SQL Injection Vulnerability — Cyber Security News

• Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs — Cyber Security News

📋 ADVISORIES

• 📄 Source for Arista EOS gNSI race condition (CVE-2026-73463) can leave revoked access active on gRPC — arista.com