CVE-2026-87886

Acronis Backup's cPanel and Plesk plugins shipped with incorrect default permissions allowing privilege escalation.

The Acronis Backup plugin for cPanel & WHM and Plesk extension shipped with incorrect default permissions, enabling attackers to escalate privileges on affected systems. DIB organizations must verify and patch these plugins immediately, as default-credential-style misconfigurations are a common attack vector that bypasses standard perimeter defenses. This failure highlights the risk of shipping software with insecure defaults, which can be exploited without needing a zero-day exploit.

Shame score — Shipping backup software with incorrect default permissions that enable privilege escalation is a negligent, avoidable failure that exposes critical infrastructure to attackers without requiring a zero-day exploit.