{"vulnerability": "CVE-2026-87886", "sightings": [{"uuid": "38e88e0a-2ea1-460f-a6ec-185e873de112", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mvm3osvhv32w", "content": "Acronis Warns of Actively Exploited Linux Privilege Escalation\u00a0Flaw\n\nAcronis has warned of CVE-2026-87886, a high-severity Linux privilege escalation vulnerability affecting its cPanel, WHM, and Plesk backup integrations.", "creation_timestamp": "2026-09-16T02:27:45.759982Z"}, {"uuid": "f1556772-3d09-4d9a-a9c4-86be53c2e196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvm5zerud22j", "content": "Acronis cPanel/WHM & Plesk backup plugin: Linux LPE CVE-2026-87886 (CVSS 7.8) under limited active exploitation. Patch to 1.9.3 HF3 / 1.8.11+. https://bleepingcomputer.com/news/security/acronis-warns-of-actively-exploited-flaw-in-its-cpanel-backup-plugin", "creation_timestamp": "2026-09-16T03:09:26.991149Z"}, {"uuid": "6f9fece7-e709-42dc-80b4-1f577dfb8712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvm6dznfny2z", "content": "Acronis disclosed CVE-2026-87886 in its cPanel, WHM, and Plesk backup plugins: a Linux local privilege escalation flaw (CVSS 7.8) already used in limited targeted attacks. #Acronis #cPanel #Plesk", "creation_timestamp": "2026-09-16T03:15:25.022562Z"}, {"uuid": "d8063cc2-cef5-4210-9a06-ef31450255fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-87886", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvmqb4tajz2l", "content": "\ud83d\udcf0 Acronis Peringatkan Celah Keamanan Plugin Backup cPanel yang Aktif Dieksploitasi\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/16/cve-2026-87886-acronis-cpanel-plesk/\n\n#acronis #cpanel #cybersecurity #keamananSiber #linux #plesk #vulnerability #webHosting #whm", "creation_timestamp": "2026-09-16T08:35:54.540604Z"}, {"uuid": "7758425f-0deb-4a4e-9371-7f9a01d71517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mvmtvqy2uk2a", "content": "Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/16/a...\n\n#backup #Linux #MSP #plugin #securityupdate #vulnerability #webhosting #cybersecurity #cybersecuritynews", "creation_timestamp": "2026-09-16T09:41:10.518980Z"}, {"uuid": "11a685e7-52d5-4407-940a-75aa6e8e9c32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvmu4p7huv2i", "content": "Acronis\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30d7\u30e9\u30b0\u30a4\u30f3\u306e\u8106\u5f31\u6027\u3001\u6a19\u7684\u578b\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-87886\uff09\n\nAcronis\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u30fb\u30ea\u30ab\u30d0\u30ea\u88fd\u54c1\u3067\u3042\u308bcPanel\u3001WebHost Manager(WHM)\u3001Plesk\u5411\u3051\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u62e1\u5f35\u6a5f\u80fd\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3059Linux\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(CVE-2026-87886)\u304c\u3001\u653b\u6483\u8005\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u540c\u793e\u304c\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002 Acronis\u306f\u706b\u66dc\u65e5\u306b\u516c\u958b\u3057\u305f\u30bb\u30ad\u30e5", "creation_timestamp": "2026-09-16T09:45:01.122047Z"}, {"uuid": "8b3e9deb-3f1a-487a-85d3-a55cf9233369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mvmwen7zwc24", "content": "Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)\n\nwww.helpnetsecurity.com/2026/09/16/a...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "creation_timestamp": "2026-09-16T10:25:16.206838Z"}, {"uuid": "75e2ceb7-a33d-475f-bc17-a4e8e0b96f55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://t.me/thehackernews/10069", "content": "\u26a0\ufe0f Acronis Backup flaw exploited in limited targeted attacks.\n\nCVE-2026-87886 lets a low-privileged attacker escalate permissions on affected Linux cPanel/WHM and Plesk deployments. Fixes are available.\n\nWhich builds need updating \u2192 https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html", "creation_timestamp": "2026-09-16T13:00:05.665580Z"}, {"uuid": "046c8436-3175-4252-b5b7-3c583e97eac2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/", "content": "CVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.\n\nThe post Acronis Patches Exploited Vulnerability in cPanel Backup Plugin appeared first on SecurityWeek.", "creation_timestamp": "2026-09-16T13:00:39.790136Z"}, {"uuid": "46ed23a1-65ad-4aa5-88e2-01801b4774f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html", "content": "Acronis has warned that a high-severity security flaw in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in the wild.\n\nThe vulnerability, tracked as CVE-2026-87886 (CVSS score: 7.8), is described as a case of local privilege escalation due to insecure file permissions. It affects the following versions -\n\n\n  Acronis Backup plugin for cPanel & WHM (Linux", "creation_timestamp": "2026-09-16T13:00:40.275443Z"}, {"uuid": "1ef32032-2d6d-48e9-bfb3-b20b74f21296", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://www.acn.gov.it/portale/w/acronis-rilevato-sfruttamento-in-rete-della-cve-2026-87886", "content": "Rilevato lo sfruttamento attivo in rete della vulnerabilit\u00e0 CVE-2026-87886 \u2013 gi\u00e0 sanata dal vendor \u2013 che interessa i plugin di backup Acronis per Plesk, cPanel e WHM. Tale vulnerabilit\u00e0, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di elevare i propri privilegi sui sistemi interessati.", "creation_timestamp": "2026-09-16T16:00:42.866761Z"}, {"uuid": "38fcb8cd-381c-4310-b751-9afc27ebd401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://t.me/information_security_channel/55925", "content": "Acronis Patches Exploited Vulnerability in cPanel Backup Plugin\nhttps://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/\n\nCVE-2026-87886 is a high-severity insecure file permissions flaw that can lead to local privilege escalation.\nThe post Acronis Patches Exploited Vulnerability in cPanel Backup Plugin (https://www.securityweek.com/acronis-patches-exploited-vulnerability-in-cpanel-backup-plugin/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-16T17:00:05.056529Z"}, {"uuid": "23be4f7b-799e-40fe-b16f-891498ae4dbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mvnvfayz252g", "content": "\ud83d\uded1 CVE-2026-87886\nAcronis Backup\nKEV \u2705\nTL;DR: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerabil\u2026\nhttps://cvesentinel.com/report/CVE-2026-87886?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-16T19:40:21.824730Z"}, {"uuid": "d5c3e9b6-c8e6-4cac-9ba0-60078b4c976d", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/320a50a7-980d-4162-b090-c53849c01837", "content": "", "creation_timestamp": "2026-09-16T20:00:02.744830Z"}, {"uuid": "b24c8dbf-2104-4ac4-afe2-01b0f408c1f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvnwkf3jhf2y", "content": "~Cisa~\nCISA added Cisco ISE and Acronis Backup flaws to its KEV Catalog, citing active exploitation.\n-\nIOCs: CVE-2026-76460, CVE-2026-87886\n-\n#CVE-2026-76460 #CVE-2026-87886 #ThreatIntel", "creation_timestamp": "2026-09-16T20:01:07.750691Z"}, {"uuid": "95335b28-ca6c-4d05-bee1-b168e8cfeb5d", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5c238c9c-ce9f-448b-b2cf-c1ad073c5b59", "content": "", "creation_timestamp": "2026-09-16T22:00:31.884662Z"}, {"uuid": "4772a0c1-b828-4957-b528-7afdc3121849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mvoaj3p3pn2x", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-87886: Acronis Backup Incorrect Default Permissions Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-87886", "creation_timestamp": "2026-09-16T22:59:21.786883Z"}, {"uuid": "4deeb776-2d71-42d1-b7df-de7b01fdbddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87886", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvoaz7jf352l", "content": "Patch Acronis Backup for cPanel/WHM and Plesk on Linux now \u2014 CVE-2026-87886 (CVSS 7.8) privilege escalation is under active exploitation and on CISA's KEV list. https://thehackernews.com/2026/09/acronis-cpanel-backup-plugin.html", "creation_timestamp": "2026-09-16T23:08:22.267263Z"}]}