Acronis Backup Incorrect Default Permissions Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-87886 to the Known Exploited Vulnerabilities Catalog on 16 September 2026, with a remediation due date of 19 September 2026 for federal civilian agencies (catalog version 2026.10.21). The record describes an incorrect default permissions vulnerability (CWE-276) in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk that could allow for privilege escalation. The CVE record names the fixed versions as 1.9.3.1021 for the cPanel & WHM plugin and 1.8.11.638 for the Plesk extension. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.002 probability of exploitation (13th percentile, 23 October 2026). CISA's ADP records exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any hosted cPanel & WHM or Plesk environment runs the Acronis Backup plugin or extension at a version before the fixed release, and patch to 1.9.3.1021 or 1.8.11.638 respectively. The incorrect default permissions could allow privilege escalation, so the record supports isolating affected hosts until the update is applied.

For a cyber underwriter, the record lets you ask an insured whether Acronis Backup for cPanel & WHM or Plesk is deployed and at what version, and require the fixed version as a control before binding or renewing. The catalog records active exploitation and total impact, which supports pricing or excluding coverage where the vulnerable version remains in place.

What would change this call

A vendor advisory or CISA update naming a different fixed version, or a change to the catalog's exploitation or ransomware fields, would change the patch and underwriting guidance above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 16 September 2026.

Sources

[1] Acronis Backup Incorrect Default Permissions Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-87886

[2] CVE record CVE-2026-87886 — https://www.cve.org/CVERecord?id=CVE-2026-87886

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog