Acronis has warned of active exploitation of CVE-2026-87886, a high-severity local privilege escalation flaw (CVSS 7.8) in its Backup plugin for cPanel and Web Host Manager (WHM) deployments. The vulnerability stems from insecure file permissions and affects specific Linux versions of the plugin. Users are advised to update their Acronis Backup plugin immediately to prevent targeted attacks.