CVE-2026-87886 Elastic Security · Elastic

Detect Acronis Backup Incorrect Default Permissions Exploitation (CVE-2026-87886) in Elastic Security

Detects exploitation of CVE-2026-87886, a KEV-listed incorrect default permissions vulnerability (CWE-276) in Acronis Backup, notably affecting the Acronis cPanel Backup plugin. Overly permissive default file/directory permissions on Acronis Backup installation directories, backup archives, agent binaries, and configuration files allow low-privilege local users to read sensitive backup data or modify agent components to achieve privilege escalation or code execution. This detection surfaces suspicious permission states, world-writable/world-readable Acronis paths, unauthorized access to backup archives by non-privileged accounts, and tampering with Acronis agent binaries and config.

MITRE ATT&CK

Tactic
Privilege Escalation Defense Evasion Collection

Elastic Detection Query

Elastic Security (Elastic)
eql 
file where event.type in ("change", "creation") and
  (file.path : ("*acronis*", "*BackupAndRecovery*", "*cpanel*backup*", "*Acronis Agent*")) and
  (file.extension in ("exe", "dll", "sh", "conf", "config", "tib", "tibx")) and
  not user.name in ("SYSTEM", "root", "acronis_agent_user") and
  not process.name in ("schedul2.exe", "mms.exe", "acronis_agent")
high severity medium confidence

EQL rule matching file changes to Acronis Backup paths by unexpected users/processes, indicating exploitation of overly permissive default permissions.

Data Sources

Elastic DefendFilebeat file integrity module

Required Tables

logs-endpoint.events.file-*auditbeat-*

False Positives & Tuning

  • Auditbeat FIM baselining runs on first deployment
  • Legitimate agent self-update processes not in the allowlist
  • Administrator-driven archive restore operations

Other platforms for CVE-2026-87886

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Set world-writable permissions on Acronis binary directory (Windows)

    Expected signal: DeviceFileEvents FileCreated for schedul2.dll under Acronis path by a non-service account; Windows 4663 access event.

  2. Test 2Read backup archive as non-privileged user (Linux)

    Expected signal: auditd file access record showing user 'nobody' opening a .tibx file under an Acronis path.

  3. Test 3Tamper with Acronis config file as unprivileged user (Linux)

    Expected signal: auditd write event for user 'nobody' modifying /etc/Acronis/agent.conf.

Last updated: 2026-09-17 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the affected host runs Acronis Backup (including the cPanel Backup plugin) and identify the installed version against Acronis advisory SEC-10986.
  2. Inspect the flagged Acronis directory/file permissions (icacls on Windows, ls -l / getfacl on Linux) to confirm world-writable/world-readable or otherwise overly permissive defaults.
  3. Identify the account that accessed or modified the file and determine whether it is a legitimate Acronis service identity or a low-privilege/unexpected user.
  4. Correlate the timestamp with any scheduled backup, validation, or update job to rule out benign automation.

Containment

  1. Restrict permissions on Acronis Backup install directories, agent binaries, config, and archive stores to the service account and administrators only (remove Everyone/Users/other write and read grants).
  2. Apply the vendor patch per Acronis advisory SEC-10986 and CISA BOD 26-04 timelines; if patching is delayed, isolate the host or disable the exposed plugin.

Evidence Collection

  1. Capture the current ACL/permission state of all Acronis paths and preserve before-remediation output (icacls / getfacl dumps).
  2. Collect file system audit logs, EDR file events, and copies of any modified agent binaries/config for forensic comparison against known-good hashes.

Escalation Criteria

  • !Escalate to incident response if a non-service account modified an Acronis agent binary or config, indicating potential privilege escalation or persistence.
  • !Escalate if backup archives (.tib/.tibx) were read or exfiltrated by an unauthorized account, indicating data exposure of protected backup contents.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >ACL/permission metadata on Acronis install directories, archive stores, and config files
  • >Modified/created Acronis agent binaries and their hashes
  • >File system audit (Windows Security 4663/Sysmon 11, Linux auditd) records of access to .tib/.tibx and agent files
  • >Acronis agent and MMS service logs

Tuning Guidance

Baseline the legitimate Acronis service account names (they vary per install, e.g. the Acronis Agent User and Acronis Managed Machine Service) and add them to allowlists. Exclude scheduled validation and update job processes by name/hash after confirming their behavior. Tighten severity for binary/config modifications by non-service accounts and lower it for read-only archive access from known backup operators. Deploy file-permission compliance checks to reduce noise from expected post-patch permission states.

Hunting Queries

Enumerate which accounts and hosts are accessing Acronis backup archives to spot non-service identities reading protected data.

Hunting — KQL
kql 
DeviceFileEvents | where FolderPath has "acronis" | where FileName endswith ".tib" or FileName endswith ".tibx" | summarize count() by InitiatingProcessAccountName, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=* object_path="*acronis*" (file_name="*.tib" OR file_name="*.tibx") | stats count by user, host | sort - count

Atomic Red Team Tests

Test 1 Set world-writable permissions on Acronis binary directory (Windows)
windows

Simulates the vulnerable state by granting Everyone modify rights on an Acronis-like directory, then a non-admin write.

Command

powershell 
mkdir C:\ProgramData\Acronis\Agent\test & icacls C:\ProgramData\Acronis\Agent\test /grant Everyone:(OI)(CI)M & echo malicious > C:\ProgramData\Acronis\Agent\test\schedul2.dll

Cleanup

powershell 
del /q C:\ProgramData\Acronis\Agent\test\schedul2.dll & rmdir /s /q C:\ProgramData\Acronis\Agent\test

Expected Telemetry

DeviceFileEvents FileCreated for schedul2.dll under Acronis path by a non-service account; Windows 4663 access event.

Expected Detection

KQL/CrowdStrike/Chronicle rules fire on non-service modification of a .dll under an Acronis directory.

Test 2 Read backup archive as non-privileged user (Linux)
linux

Simulates a low-privilege user reading a world-readable Acronis backup archive.

Command

bash 
sudo mkdir -p /var/lib/Acronis/backups && sudo sh -c 'echo backupdata > /var/lib/Acronis/backups/system.tibx' && sudo chmod 644 /var/lib/Acronis/backups/system.tibx && runuser -u nobody -- cat /var/lib/Acronis/backups/system.tibx

Cleanup

bash 
sudo rm -f /var/lib/Acronis/backups/system.tibx && sudo rmdir /var/lib/Acronis/backups

Expected Telemetry

auditd file access record showing user 'nobody' opening a .tibx file under an Acronis path.

Expected Detection

SPL/Elastic/Sumo rules fire on non-root access to a .tibx archive in an Acronis directory.

Test 3 Tamper with Acronis config file as unprivileged user (Linux)
linux

Simulates modification of an Acronis agent config via incorrect default permissions.

Command

bash 
sudo mkdir -p /etc/Acronis && sudo sh -c 'echo original > /etc/Acronis/agent.conf' && sudo chmod 666 /etc/Acronis/agent.conf && runuser -u nobody -- sh -c 'echo tampered >> /etc/Acronis/agent.conf'

Cleanup

bash 
sudo rm -f /etc/Acronis/agent.conf && sudo rmdir /etc/Acronis

Expected Telemetry

auditd write event for user 'nobody' modifying /etc/Acronis/agent.conf.

Expected Detection

Elastic EQL / SPL rules fire on non-service modification of an Acronis .conf file.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0005Defense EvasionTA0009Collection

Related Techniques

T1574Hijack Execution FlowT1222File and Directory Permissions ModificationT1005Data from Local System

Same Tactic: Privilege Escalation

Popular Detections