3 new KEV entries: Acronis Backup and what else CISA flagged

On 2026-09-16 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three new entries to its Known Exploited Vulnerabilities (KEV) catalog. KEV inclusion is not a severity score; it is a declaration that CISA has evidence of active, in-the-wild exploitation. For federal civilian executive branch agencies, that starts a Binding Operational Directive 22-01 clock. For everyone else, KEV remains the most defensible prioritization signal available when you need to move faster than a routine patch cycle.

This post focuses on the lead entry (an Acronis Backup privilege escalation) and covers one companion in less depth (the Cisco Identity Services Engine web management bypass). The third same-day addition, an improper authorization flaw in the Google Pixel cellular modem tracked as CVE-2026-58704, is a device-fleet problem that warrants its own writeup and is out of scope here.

The lead: CVE-2026-87886 in Acronis Backup for cPanel, WHM, and Plesk

CISA describes CVE-2026-87886 as an incorrect default permissions vulnerability in the Acronis Backup plugin for cPanel and WHM and the equivalent extension for Plesk. The consequence is privilege escalation. The flaw is not in the backup transport, the cloud storage tier, or the restore workflow; it is in the on-disk permissions set when the plugin is installed or upgraded on a hosting control panel.

Incorrect default permissions maps to CWE-276. In hosting control panel environments, that class of flaw typically manifests as one of two patterns:

Either pattern lets a low-privilege tenant on a shared hosting node alter state that a root process later trusts. On cPanel and Plesk hosts, the plugin runs as root so it can snapshot any customer account; a tenant who can influence its inputs can typically pivot to root and then to every other tenant on the same host.

A read-only sweep gives an initial exposure check. Paths and package names vary by plugin version, so treat the following as a template to tune to your environment, not a definitive check:

# Enumerate suspicious permissions under the plugin's install root.
# Replace /usr/local/acronis with the actual install path on your build.
PLUGIN_ROOT=/usr/local/acronis

# 1. World- or group-writable files and dirs owned by root.
find "$PLUGIN_ROOT" -xdev \( -perm -o+w -o -perm -g+w \) \
  -user root -printf '%M %u:%g %p\n'

# 2. Setuid / setgid binaries shipped by the plugin.
find "$PLUGIN_ROOT" -xdev -type f \( -perm -4000 -o -perm -2000 \) \
  -printf '%M %u:%g %p\n'

# 3. Cron entries that invoke plugin scripts as root.
grep -RIn --color=never acronis /etc/cron.d /etc/cron.daily \
  /etc/cron.hourly /var/spool/cron 2>/dev/null

Sweep findings are inputs, not answers. The real question is whether the installed version appears on the vendor's fixed list. Match your package version against the vendor advisory, and treat any host where the plugin auto-updater has been disabled as presumed vulnerable until proven otherwise.

Why CISA judged this actively exploited

CISA does not publish per-entry telemetry, and this post will not speculate on threat-actor attribution. The KEV entry alone confirms that the agency has evidence meeting its inclusion criteria: reliable evidence of execution against a target in the wild. For defenders, this is no longer a theoretical CVE waiting for a proof of concept. Exploitation has been observed; the risk model shifts from "attackers might" to "attackers are."

Am I affected, and what do I do inside the deadline

Three questions, in order:

  1. Do you run cPanel, WHM, or Plesk anywhere in your estate, including shadow IT, acquired-company footprints, or developer sandboxes exposed to the internet? If yes, is the Acronis Backup plugin or extension installed?
  2. Is the installed version at or above the vendor's fixed release? If your inventory cannot answer that in minutes, the gap is itself a finding; the KEV clock does not pause for inventory.
  3. If you cannot patch within the BOD 22-01 timeline, can you restrict low-privilege tenant logins on affected hosts and tighten filesystem permissions on the plugin's install root to remove world- or group-writable bits while you wait for the update?

The third question describes a compensating control, not a fix. Incorrect default permissions vulnerabilities are typically straightforward to patch once the vendor ships an updated package; the risk of delay is that the exploitation window is already open.

The companion: CVE-2026-76460 in Cisco ISE and ISE-PIC

CVE-2026-76460, also added on 2026-09-16, covers an incorrect use of privileged APIs in Cisco Identity Services Engine (ISE) and the ISE Passive Identity Connector (ISE-PIC). CISA describes the impact as an unauthenticated remote attacker gaining unauthorized access by bypassing the web-based management interface.

ISE sits in the trust path for network access control, TACACS+, and posture assessment; a management-plane bypass is a bypass on the plane that decides who gets on your network. Treat any internet-reachable ISE management interface as a Priority 1 finding, and audit whether the management VLAN is reachable from user-accessible segments. Two operational checks worth running today:

Two useful reminders

First, KEV is not an exhaustive list of what is being exploited; it is what CISA has confirmed. Absence from KEV is not evidence of safety. Second, the value of a KEV-driven program is not in the reactive scramble on listing day; it is in the standing capability to answer "which assets run the affected software, at which versions, exposed to whom" in minutes rather than days. If today's additions cost you a week to scope, that gap is the finding to fix before the next batch.

Verifiable security.