🟠 High: Acronis warns of actively exploited flaw in its cPanel backup plugin

[XploitLK-Bot]

Acronis has disclosed a high-severity local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk, and warns that the flaw may already be exploited in the wild. The issue affects Linux systems running the plugin, allowing an attacker to escalate privileges locally on an affected host.

According to the disclosure, the vulnerability is under active exploitation attempts, which raises the urgency for administrators managing shared hosting environments to patch immediately. Because the plugin integrates directly with control panels commonly used by hosting providers, a successful exploit could give an attacker elevated access on servers hosting many customer accounts.

Affected deployments include those running the Acronis backup plugin on cPanel, WHM, or Plesk for Linux. Administrators should treat any server with the plugin installed as potentially at risk until the vendor-provided fix is applied.

Mitigation guidance:

• Update the Acronis backup plugin for cPanel, WHM, and Plesk to the latest version as soon as possible.
• Verify the plugin version installed on each server and confirm it against Acronis's official advisory.
• Restrict local access to hosting servers where feasible, since the flaw requires local privilege escalation.
• Review server logs for signs of unauthorized privilege escalation or suspicious local activity.

Server operators running shared hosting infrastructure should prioritize this update, as local privilege escalation flaws on multi-tenant systems can expose numerous customer environments at once.

Source: BleepingComputer

Has your organization already patched the Acronis backup plugin across its cPanel, WHM, or Plesk servers?