CVE-2026-87886

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Sep 18, 2026

Description

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Sep 18, 2026
Added to CISA KEV
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-878888.0The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowingCVE-2026-87898.1The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing CVE-2026-878905.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django CVE-2026-878916.5The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday scCVE-2026-878925.3The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own seCVE-2026-878945.3The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking'sCVE-2026-878965.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking ageCVE-2026-878989.4OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-878999.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87906.1The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox wiCVE-2026-879009.4Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute aCVE-2026-879018.3Improper sanitization in the registration module allows reflected Cross-Site Scripting.