The other new KEV is a backup plugin. That should bother you.

CISA added two rows to KEV on September 16. One was Cisco ISE. The other was a backup plugin. CVE-2026-87886 is a local privilege escalation in Acronis Backup for cPanel and WHM, and in the Plesk extension. Insecure file permissions on Linux. CVSS 7.8. Acronis says it has seen limited, targeted attacks against the cPanel plugin. Not against Plesk, so far.

Why a hosting plugin is a recoverability story

These add-ons sit on the same Linux box that already holds customer sites, mailboxes, and databases. They connect that box to Acronis cloud so a host or an MSP can sell backup under their own brand. If a low-privileged account on that server can escalate through the backup plugin, the thing that was supposed to be the last copy is now a step toward root.

That is the week we keep having. Ransomware crews go after the backup and the hypervisor, not only the file share. A green job in a console is not evidence you can recover if the plugin that writes the copies is the hole.

Acronis has not published a public playbook of what the attackers did after they escalated. They do not need to. An attacker with root on a cPanel host can read customer data, alter backup jobs, or delete the copies that were meant to survive the week.

Who should care in Canada

Shared hosts, MSPs, and anyone who bought "Acronis inside cPanel" as the official backup story. If you are a customer of a host, ask which plugin build they run. You will not patch their box. You can ask whether they applied 1.9.3 HF3 (build 1.9.3.1021 or later) and whether they have a restore test dated after the patch.

Plesk shops should still move to 1.8.11 (build 1.8.11.638 or later). Absence of reported exploitation is not a reason to wait out a KEV listing.

What we would check

• On each Linux host: plugin or extension build. Anything older than the numbers above is overdue.
• Who has a shell account on that host. LPE starts with a foothold. Shared hosting is full of footholds.
• Whether backup credentials and job definitions are reachable from a web user. If they are, treat that as a finding even after the patch.
• A dated restore of a named site or mailbox. The report an insurer wants is the restore, not the logo on the plugin.

Bottom line

Backup software with loose file permissions is how a hosting account becomes the recovery failure. Forensic Five reviews what is copied, who can wipe it, and whether a restore has been proven. From St. Albert, Alberta. The plugin version is a starting point, not the whole answer.