CISA adds an Acronis Backup flaw to its exploited list

The Cybersecurity and Infrastructure Security Agency added three flaws to its Known Exploited Vulnerabilities catalogue on 16 September, and gave US federal agencies until 19 September to deal with them. Two of the three were already well covered by their vendors. The one worth your attention is CVE-2026-87886, a privilege-escalation bug in the Acronis Backup plugins that sit inside cPanel, Plesk and DirectAdmin control panels on Linux servers.

What the flaw actually is

Acronis describes it as local privilege escalation caused by insecure file permissions, and NVD carries the vendor's CVSS 3.0 score of 7.8, rated high. The affected builds are the Acronis Backup plugin for cPanel and WHM before build 1.9.3.1021, the Acronis Backup extension for Plesk before build 1.8.11.638 and the Acronis Backup plugin for DirectAdmin before build 1.2.3.238. Nothing needs to be exploited over the internet to reach it, which is exactly why the listing matters: "local" here means anyone who already has a small foothold on the box.

Where the risk really lands

These plugins exist to back up hosting accounts, so they run as privileged code on machines that stack dozens or hundreds of unrelated customers on the same operating system. A tenant who can write outside their own directory, or a compromised reseller account, is the starting position. Escalating from there means reaching other customers' files and the host's own configuration, which is a far more expensive mess than the average site defacement. CISA's entry also flags forensic triage, a signal that the agency wants logs preserved rather than simply patched and forgotten. Ransomware use is listed as unknown, so there is no evidence either way yet.

The other two additions

The same catalogue update added CVE-2026-58704, an improper authorisation flaw in the Google Pixel cellular modem where a logic error lets an attacker skip permission checks and escalate privileges, and CVE-2026-76460, an incorrect use of privileged APIs in Cisco Identity Services Engine and ISE Passive Identity Connector that lets an unauthenticated remote attacker bypass the web management interface. All three carry the same 19 September due date, the same required action of applying vendor mitigations under BOD 26-04, and the same forensic triage requirement.

Our opinion

For years the interesting question about exploited-vulnerability notices was which piece of enterprise kit was on fire. This one points somewhere far less glamorous and far more common: the backup plugin bolted into a control panel, installed by a hosting company in 2023, updated when somebody remembers. Hosting panels are the load-bearing infrastructure of the small web, and their plugin ecosystems get a fraction of the security attention that the panels themselves receive.

A three-day federal deadline also flatters the reality. Large agencies with patch pipelines can move that fast. The people actually running these plugins are two-person hosting firms who will see the notice on a support forum next week. The honest advice is unglamorous: check which Acronis build is sitting on your panel, update it now, and treat any host that cannot tell you its version as the real vulnerability.