Acronis Backup Plugin Vulnerability
On 15 Sep, BleepingComputer reported that Acronis had warned of an actively exploited flaw in its cPanel backup plugin. Exploitation preceded public understanding, a familiar and unpleasant sequence for a security disclosure.
On 20 Sep, Dev.to identified the issue as CVE-2026-87886 and described insecure file permissions in Acronis Backup plugins for cPanel, WHM, and Plesk. That follow-up expanded the stated product scope beyond the cPanel plugin named in the first report.
Separate reports from BleepingComputer and The Hacker News have covered exploited cPanel and WHM flaws. These include a zero-day with public proof-of-concept code, attacks against government and MSP networks, and LiteSpeed cPanel plugin vulnerabilities used for root privilege escalation. Those reports cover the wider cPanel security picture and are distinct from CVE-2026-87886.
If factual, the impact is 0%. Administrators running the affected Acronis Backup plugins for cPanel, WHM, or Plesk are directly affected. The supplied reporting records no broader operational, financial, or user impact.
Watch for an Acronis advisory detailing affected versions, remediation, and evidence about the exploitation campaign. Further reporting should clarify which of the three plugin environments were exploited and which were exposed by the same permissions flaw.
The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been leveraged in attempts since
cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel
A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS
A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of managed service providers (MSPs)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw impacting LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities (KEV) catalog,
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →