Federal cybersecurity authorities have updated the Known Exploited Vulnerabilities catalog to mandate remediation for a security flaw in enterprise backup and recovery software. Local unprivileged users exploit incorrect default file permissions to elevate privileges and manipulate local backup archives.
The vulnerability, tracked as CVE-2026-87886, impacts Acronis Cyber Protect Backup installations. The security defect stems from overly permissive default file system access controls assigned to local service directories during installation. A local unprivileged attacker can modify application execution binaries or configuration scripts, achieving local privilege escalation to SYSTEM or root privileges and tampering with stored disaster recovery archives. CISA mandated federal civilian agency patching under Binding Operational Directive 26-04.
Compromising local disaster recovery agents undermines system recovery capabilities across corporate endpoints. When local attackers obtain SYSTEM privileges via backup daemon subversion, adversaries can disable endpoint security monitoring, erase local shadow copies, and execute secondary extortion payloads.
– Apply official software maintenance updates published by Acronis across all enterprise backup agent deployments immediately.
– Inspect local file system permissions assigned to Acronis installation directories to ensure restricted access for non-admin users.
– Review local privilege escalation logs and process creation trees associated with backup daemon executables.
– Maintain immutable, air-gapped backup storage repositories isolated from local endpoint administrative accounts.
Backup agent security depends on strict local permission scoping and continuous endpoint monitoring to ensure disaster recovery services remain protected from unprivileged privilege escalation vectors. #CodeDefence #Acronis #BackupSecurity #PrivilegeEscalation #CISA #KEV #EndpointSecurity #AppSec
/
