Acronis: Active Breach in cPanel
Does your hosting server have a backdoor that’s already being exploited?
Acronis has confirmed real attacks against its backup plugin for cPanel.
The Acronis plugin for cPanel & WHM manages disk-level backups. It protects critical data on thousands of Linux production servers — and a flaw there touches everything.
The issue lies in the plugin’s file permissions. An attacker who exploits them can escalate privileges and gain control over resources they should never be able to access.
The attacks are already happening — they are not hypothetical in the slightest.
The vulnerability, identified as CVE-2026-87886 with a CVSS score of 7.8, allows an attacker to leverage insecure file permissions to elevate their privileges on the system. Acronis has confirmed it in its own security advisory: real, targeted, and limited attacks have been detected against deployments of the Backup plugin for cPanel & WHM. This is not a precautionary alert — it is an active, ongoing exploitation.
Limited and targeted, yes — but real and underway.
The fact that the attacks are “limited and targeted” does not mean the risk is lower: it means someone is choosing specific targets and acting on them. All Linux versions of the Backup plugin for cPanel & WHM prior to build 1.9.3.1021 are affected. The equivalent extension for Plesk, in versions prior to build 1.8.11.638, is also vulnerable, although no attacks against it have been recorded so far.
Acronis has not explained how the flaw works, and that makes defense harder.
The company has chosen not to publish technical details of the exploit to avoid making things easier for other attackers. It is an understandable decision, but it leaves administrators without the context needed to assess the risk. The only lever available right now is to update as soon as possible: there is no documented workaround or alternative measure.
Without the patch applied, the door remains open.
Acronis has already released the fixed versions and is calling for immediate updates. If you manage hosting servers running cPanel & WHM or Plesk with the backup plugin installed, checking the version you are currently running is not optional.
Shared hosting multiplies the damage.
A hosting server does not host a single client: it hosts dozens or hundreds. If an attacker escalates privileges in that environment, the blast radius skyrockets. We are not talking about compromising one website, but about accessing the data, credentials, and configuration files of every site sharing that machine. This is exactly the type of target that maximizes the return on effort for any attacker.
cPanel has been in attackers’ crosshairs for months.
This is not the first time cPanel & WHM has been at the center of an active alert. The hosting ecosystem is a recurring target because it combines high market penetration with resource-limited administrators and servers that are rarely updated on time. That combination makes it fertile ground.
The Plesk extension is also vulnerable, though not yet attacked.
The fact that attackers have not yet targeted the Plesk extension does not mean they will not. The vulnerability exists in both products. Waiting for attacks to arrive before updating would be a mistake that could prove costly.
The patch already exists — the decision is yours.
Acronis has published the fixed versions for both products. The Backup plugin for cPanel & WHM must be on build 1.9.3.1021 or higher. The Plesk extension must be on build 1.8.11.638 or higher. Verifying the installed version and applying the update closes a real exposure — not a theoretical one.
Minutes to update, months of risk avoided.
If you manage hosting environments with these tools, the question is not whether you should update, but how long you have been exposed without knowing it.
What to do now
- ✓Update the Backup plugin for cPanel to build 1.9.3.1021.
- ✓Update the Plesk extension to build 1.8.11.638 or higher immediately.
- ✓Review server logs to detect privilege escalation.
When was the last time I checked the version of my backup plugins?
Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.
Related articles
TP-Link Omada Hit by Chain Attack
Does your enterprise network rely on cloud-managed TP-Link Omada devices?
FortiMail under zero-day attack
Is your corporate mail server being attacked right now without your knowledge?
ClingSTUN is lurking in your network
Do you know how many connected devices in your home have been working for someone else for months?
Shodan scans you without you noticing
Did you know someone can map your network without sending you a single packet?
Pentagon data breach lasted nine months
Did you know that the most sensitive U.S. military data was exposed for months?
Nacata Security, reach out to us anytime
We are Nacata Security, get to know us
web: nacata.io
email: info@nacata.io
Phone: 919930793
LinkedIn: Nacata Security
Risks and attacks happening right now: vulnerabilities being actively exploited, official alerts from cybersecurity agencies, ongoing phishing or malware campaigns.
Information meant to help you act and protect yourself before the problem reaches you.
RATING
9.4
Who are we?
At Nacata Security we are an offensive cybersecurity company specialized in audits and penetration testing.
We detect, assess and help mitigate the vulnerabilities of your systems, networks and applications before a real attacker exploits them, offering 360º defense tailored to each client.
We’d be glad to get in touch with you for whatever you need.