Status: KEV | Advisory ID: CVE-2026-87886
| CVE | CVE-2026-87886 |
| CVSS | CVSS 7.8 (High): attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Incorrect default file permissions in compiled code require a code update. On historical data platforms and backup systems typically allow ingest from multiple different platforms at high volume. These systems frequently also store confidential data and may have regulatory impact for data retention. These factors lead to higher exposure to embedded malicious code and significant impact from loss or compromise of the system. Expedited patching should be considered based on the system exposure and classification. |
| Affected products | Acronis Backup and Acronis Acronis Backup |
| Exploitation status | Listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. |
| Classified as | CWE-276 (Incorrect Default Permissions) |
| KEV listing | Added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-09-16. |
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-87886 |
| Vendor advisory | https://security-advisory.acronis.com/advisories/SEC-10986 |