CVE-2026-87886
Local privilege escalation due to insecure file permissions.
High
Known exploited
- Severity
- 7.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.23%
- Chance of exploitation in the next 30 days. Higher than 14.24% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 16, 2026
- Weakness
- CWE-276 Incorrect Default Permissions
- Fix
- None yet
- No fixed version published
Exploited in the wild. Acronis Backup Incorrect Default Permissions Vulnerability (Acronis Backup). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Sep 19, 2026.
Description
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 7.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it
- Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Last updated by the source
- Remediation due for U.S. federal agencies
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6x7x-gcmf-7r8x YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action | Critical | Same weakness, CWE-276 |
| GHSA-rwp6-7w3q-75fq OpenClaw: Config recovery could restore openclaw.json with broad file permissions | Medium | Same weakness, CWE-276 |
| GHSA-534h-c3cw-v3h9 Nuxt dev server vite-node IPC socket is world-connectable on Linux | Medium | Same weakness, CWE-276 |
| GHSA-99qx-5qqr-4j95 Apache ActiveMQ has an Incorrect Default Permissions vulnerability | High | Same weakness, CWE-276 |
| GHSA-q5f5-3gjm-7mfm Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool | Medium | Same weakness, CWE-276 |
| GHSA-vr7j-g7jv-h5mp OpenClaw session transcript files were created without forced user-only permissions | Medium | Same weakness, CWE-276 |
| GHSA-crjq-wm6x-6qx7 .NET Elevation of Privilege Vulnerability | High | Same weakness, CWE-276 |
| GHSA-9hh7-6558-qfp2 Mattermost allows other users to determine when users had read channels via channel member objects | Low | Same weakness, CWE-276 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor