CVE-2026-87886KEV · OVERDUECWE-276

Acronis Backup Incorrect Default Permissions Vulnerability

High · published September 18, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 13.4th percentile for exploit probability.

35
days past CISA
deadline
CVSS v3.0
7.8
EPSS
0%
Percentile
13.4
In the wild
Confirmed
What it is

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-09-18T03:18Z
KEV added
2026-09-16 · due 2026-09-19
Affected products (6)
ProductVersionsFixed in
acronis/acronis_backup< 1.2.31.2.3
acronis/acronis_backup< 1.8.111.8.11
acronis/acronis_backup< 1.9.31.9.3
acronis/acronis_backupall versions—
acronis/acronis_backupall versions—
acronis/acronis_backupall versions—
References (2)
https://security-advisory.acronis.com/advisories/SEC-10986 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:54Z
    EPSS moved — → 0%
    epss
  • 17 SEP 22:57Z
    Local privilege escalation due to insecure file permissions
    cvelistv5
  • 16 SEP 00:00Z
    Added to CISA KEV — remediate by Sep 19
    kev