Acronis cPanel plugin flaw exploited in the wild

Acronis has issued a security advisory for a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk. The company confirmed that the flaw is being exploited in the wild, though it did not specify the scale or targets of the attacks.

What happened

The vulnerability affects the Acronis Cyber Protect Backup plugin, which integrates with cPanel, WHM, and Plesk control panels to provide backup and recovery functionality. According to Acronis, the flaw allows attackers with local access to escalate privileges on Linux-based systems where the plugin is installed. The company did not disclose technical details about the exploit mechanism, citing ongoing investigations and active exploitation.

Acronis released a patch for the vulnerability but has not provided a specific timeline for when the fix was made available. The advisory urges users to update to the latest version of the plugin immediately. No workarounds or mitigations were suggested in the disclosure.

What we don’t know yet

The sources do not specify the number of affected systems, the identity of the threat actors, or the geographic distribution of the attacks. It is also unclear whether the exploitation has resulted in data breaches, ransomware deployments, or other malicious outcomes. Acronis has not indicated whether the vulnerability is being exploited as part of a broader campaign or as an isolated incident.