CVE-2026-87886High· 7.8▾ Abyssal⚠ Exploited in the wild0dayPoC availableLocal privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638,…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 0 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Federal remediation due Sep 19, 2026
Disclosed via NVD
Last analysed / modified upstream
0.3%
Exploit / PoC code exists
Added to the CISA catalog on Sep 16, 2026. Federal remediation due Sep 19, 2026. View catalog ↗
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
acronis_backup < 1.2.3acronis_backup < 1.8.11acronis_backup < 1.9.3acronis_backup = 1.9.3Upgrade past the affected range:
acronis_backup 1.9.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87096Low· 3.3Sensitive information disclosure and manipulation due to improper authorization checks
CVE-2026-87095Critical· 9.1Sensitive information disclosure and manipulation due to improper authorization checks
CVE-2026-85300Medium· 5.5Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
CVE-2022-32207Critical· 9.8When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accide…
CVE-2023-20178High· 7.8A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges t…
CVE-2024-1488High· 8.0A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration