According to The Hacker News, Acronis has warned that a high-severity vulnerability in its Backup plugin for cPanel and Web Host Manager (WHM) deployments has been exploited in targeted attacks. The issue is tracked as CVE-2026-87886 and carries a CVSS score of 7.8.
The flaw is described as a local privilege escalation vulnerability, which suggests an attacker who already has some level of access could potentially elevate their privileges on an affected system. Because the plugin is used in hosting control-panel environments, the exposure may be significant for managed service providers and server administrators.
Acronis's warning confirms real-world exploitation, meaning this is not just a theoretical risk. Since this article draws on a single source, there are no differing reports to compare, but the consistent message is that administrators using the affected plugin should treat it as an active security concern.