Photo by Taylor Vick on Unsplash
In the hosting business, we spend an enormous amount of time worrying about the front door—brute force attacks on SSH, WordPress vulnerabilities, or poorly configured firewalls. We rarely stop to think that the very tools we install to protect the data might be the ones handing over the keys to the kingdom.
Acronis recently addressed a significant security hole in its backup plugin for cPanel and WHM. The vulnerability, tracked as CVE-2026-87886, stems from something as fundamental as insecure file permissions. While the term 'privilege escalation' sounds like corporate jargon, in the hosting world, it means a low-level user can suddenly act as the root administrator. According to reports from WebHosting.today, this wasn't just a theoretical risk; the flaw has been spotted in the wild in targeted attacks. The fix is already out in version 1.9.3 HF3, and CISA has added it to their list of known exploited vulnerabilities.
Why this matters for your fleet
This is a wake-up call for two reasons. First, backups are the ultimate prize for an attacker. If you control the backup agent, you control the data and the server. Second, the 'set it and forget it' mentality for control panel plugins is a liability. We often automate the updates for the OS and the control panel itself but treat third-party plugins as secondary concerns. When those plugins run with high-level system permissions, they deserve the same scrutiny as the kernel.
For providers managing hundreds or thousands of nodes, this is an operational headache. It’s not just about clicking 'update' in one place; it’s about verifying that the patch propagated across the entire infrastructure before someone uses this exploit to turn your backup routine into a data exfiltration routine. In an era where ransomware is a professional industry, a 7.8 CVSS score on a backup tool is essentially a red carpet for bad actors.
I’ve always found it ironic that the software we buy to prevent disasters is occasionally the disaster itself. It's like buying a high-end deadbolt only to realize the manufacturer left a spare key under the welcome mat.
The Bottom Line
Patch your plugins. If you are running Acronis on cPanel, stop reading this and verify you are on version 1.9.3 HF3 or higher. In the hosting world, you are only as secure as the weakest permission setting on your most trusted tool.