EUVD-2026-82595
GHSA-hrq3-qgq7-jm9x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Insecure file permissions let a local low-privileged user (PR:L, AV:L, AC:L) tamper with root-run backup files for full root compromise (C:H/I:H/A:H), matching vendor 7.8.
Primary rating from Vendor (acronis).
CVSS VectorVendor: acronis
Lifecycle Timeline
5DescriptionCVE.org
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.4.238.
AnalysisAI
Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an existing local, low-privileged account or shell on a Linux server that has the vulnerable Acronis Backup integration installed: the cPanel & WHM plugin before build 1.9.3.1021, the Plesk extension before build 1.8.11.638, or the DirectAdmin plugin before build 1.2.4.238. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade each installed integration to at least the fixed build - Acronis Backup plugin for cPanel & WHM build 1.9.3.1021, Acronis Backup extension for Plesk build 1.8.11.638, and Acronis Backup plugin for DirectAdmin build 1.2.4.238 - per the vendor advisory at https://security-advisory.acronis.com/advisories/SEC-10986. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Linux host running cPanel/WHM, Plesk, or DirectAdmin that has an Acronis Backup integration plugin installed, and audit the file and directory permissions on plugin-installed paths for group- or world-writable defaults; where insecure permissions are found, immediately restrict them to root ownership with no group or other write access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today