Acronis cPanel Backup Plugin Flaw Is Being Exploited: The Low-Privilege Account That Can Own Your Whole Hosting Server

Acronis has confirmed limited, targeted exploitation of a 7.8-rated local privilege escalation flaw in the backup plugin that hundreds of hosting companies run on their cPanel and Plesk servers. The attack path is short: one low-privileged account on a shared box, one unpatched plugin, root on the machine that hosts everyone else.

What happened

On September 15, Acronis published a full advisory for CVE-2026-87886, a high-severity vulnerability in its backup add-ons for cPanel & WHM and Plesk, first reported by BleepingComputer. The company had disclosed the flaw in a brief notice over the previous weekend; the expanded advisory carries a CVSS score of 7.8 and, the part that should get a hosting operator’s attention, confirmation that exploitation has already been detected in the wild.

The scope is narrow for now. Acronis says the assessment rests on a single report from a “potentially affected” customer, and the attacks it observed were limited and targeted, aimed specifically at cPanel & WHM deployments.

Why a backup plugin is a serious target

The Acronis add-ons connect a hosting control panel to Acronis’s infrastructure so administrators can back up and restore websites, files, databases, mailboxes, and whole hosting accounts from inside cPanel or Plesk. Think about what sits behind that interface. A backup agent that can restore any account on the server can read any account on the server. It runs with privileges ordinary customers never get.

A local privilege escalation in that component flips the hosting business model inside out. On shared hosting, the baseline promise is isolation: customer A cannot touch customer B’s files, database, or mail. This flaw lets a low-privileged account, possibly nothing more than a standard hosting customer on the very same box, lift itself to root without any user interaction. From there the attacker holds every account on the machine: source code, database credentials, mailboxes, and the backup archives themselves, which contain copies of all of it.

This is not a theoretical chain. Hosting servers are dense with exactly the accounts an escalation flaw needs, and backup software is one of the few components on a typical cPanel box that runs privileged and reachable from ordinary customer land.

What we know and what we don’t

Acronis has deliberately withheld technical details on the flaw. That is a reasonable call: it gives administrators time to patch before exploit code circulates. So the fixed facts are these. The vulnerability is a local privilege escalation, CVSS 7.8, in the Linux backup add-ons for cPanel & WHM and Plesk. Exploitation is confirmed in the wild, limited and targeted, based on one customer report. Patches are available now, and Acronis is recommending all affected users apply them immediately.

Everything else is still blank. There are no published indicators of compromise, no attack timeline, no attribution, and no confirmed statement of what the attackers achieved after escalating. Targeted attacks with no IOCs are the hardest kind to detect, because you cannot grep for a hash if nobody has released one. For most hosting operators the only honest position right now is that the patch race is live.

What African hosting operators should do

South Africa and the wider continent run a long tail of reseller and shared-hosting shops, many on a single fat cPanel server with no segmented management network. If your operation uses Acronis backup integrations, here is the order I would work in.

1. Apply the vendor update on every control-panel server today. This is not a wait-for-the-change-window flaw; exploitation is confirmed.
2. Audit recent privileged activity on those servers. Look for account creations, sudo/su anomalies, and cron changes nobody can explain. Without IOCs, behavioral baselining is what you have.
3. Check who actually needs an account on a box running the plugin. Every reseller and customer shell account is a potential foothold for an escalation attempt.
4. Treat your backup archives as sensitive production data, because they are. Restrict where restore operations can point and who can trigger them.

Customers of hosting providers have a cheaper mitigation: ask your provider, in writing, whether their backup software is patched and how quickly they apply vendor security updates. An operator that flinches at that question is telling you something.

The eHawu view

A privilege escalation flaw is a host-level problem, but every breach we examine ends up exposing the same gap one level up: nobody was watching the control path. eHawu’s network-layer platform sits between your servers and the internet, inspecting traffic regardless of encryption and surfacing the anomalous sessions an escalation attempt generates, the outbound connections and lateral movement that a root takeover almost always produces. When the flaw lives inside trusted vendor software on your control panel, perimeter trust stops meaning anything. Your network traffic is the last place the truth shows up.

Book a demo at ehawu.africa, or talk to us about your hosting estate’s visibility posture before the next vendor advisory turns it into a race.