Acronis Backup default-permissions bug added to CISA's exploited list
On September 16, 2026, CISA added CVE-2026-87886, incorrect default permissions in Acronis Backup, to the Known Exploited Vulnerabilities catalog because of evidence it was being exploited.
What was reported
The same CISA alert lists CVE-2026-87886 as "Acronis Backup Incorrect Default Permissions Vulnerability," added to the Known Exploited Vulnerabilities catalog on September 16, 2026. CISA says the addition is based on evidence of active exploitation. It does not publish a version range on that page.
Backups are a second copy of the data an attacker wants. A default that is too open on the product that holds those copies is the same class of mistake as shipping an app with a test password still set.
How to prevent it
Do not leave a backup console on the permissions it shipped with, and do not leave it on the public internet. Apply Acronis's update for CVE-2026-87886, then confirm the management interface is only reachable from a network you control.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.