{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-18T05:04:05.690","vulnerabilities":[{"cve":{"id":"CVE-2026-87886","sourceIdentifier":"security@acronis.com","published":"2026-09-17T23:18:53.763","lastModified":"2026-09-18T00:17:48.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238."}],"affected":[{"source":"security@acronis.com","affectedData":[{"vendor":"Acronis","product":"Acronis Backup plugin for cPanel & WHM","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"unspecified","lessThan":"1.9.3.1021","versionType":"semver","status":"affected"}]},{"vendor":"Acronis","product":"Acronis Backup extension for Plesk","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"unspecified","lessThan":"1.8.11.638","versionType":"semver","status":"affected"}]},{"vendor":"Acronis","product":"Acronis Backup plugin for DirectAdmin","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"unspecified","lessThan":"1.2.3.238","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@acronis.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"cisaExploitAdd":"2026-09-16","cisaActionDue":"2026-09-19","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Acronis Backup Incorrect Default Permissions Vulnerability","weaknesses":[{"source":"security@acronis.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"references":[{"url":"https://security-advisory.acronis.com/advisories/SEC-10986","source":"security@acronis.com"}]}}]}