CVE-2026-87886

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Sep 18, 2026

Description

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

VendorProductVersions
AcronisAcronis Backup plugin for cPanel & WHM>= unspecified, < 1.9.3.1021
AcronisAcronis Backup extension for Plesk>= unspecified, < 1.8.11.638
AcronisAcronis Backup plugin for DirectAdmin>= unspecified, < 1.2.3.238

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 18, 2026
Added to CISA KEV
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-878888.0The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowingCVE-2026-87898.1The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing CVE-2026-878905.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django CVE-2026-878916.5The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday scCVE-2026-878925.3The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own seCVE-2026-878945.3The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking'sCVE-2026-878965.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking ageCVE-2026-878974.6A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for anotCVE-2026-878989.4OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-878999.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87906.1The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox wiCVE-2026-879009.4Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a