Acronis Backup flaw added to US exploited-vulnerabilities list, here's what's actually known
CISA says CVE-2026-87886 is being actively exploited, but the public record is thin on how, by whom, and whether a fix even exists.
The claim
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in Acronis Backup, tracked as CVE-2026-87886, to its Known Exploited Vulnerabilities (KEV) catalogue. The listing went live on 16 September 2026, and CISA is telling US federal civilian agencies they have until 19 September, just three days, to apply mitigations. That short a fuse is CISA’s way of signalling this isn’t a theoretical bug sitting in a lab somewhere: someone, somewhere, is already using it against real targets.
That’s genuinely the headline fact here. Everything else needs a bit more scrutiny.
What we actually know, and what we don’t
CISA’s own entry confirms the vendor (Acronis), the product (Backup), the date added, and the compressed deadline. It also flags the “ransomware” field as “Unknown,” which is CISA-speak for “we haven’t confirmed this is being used to deploy ransomware, but we’re not ruling it out either.”
What the entry doesn’t tell us, at least from what’s publicly visible right now, is much about the mechanics of the flaw itself, no CVSS severity score, no description of whether this is a remote code execution issue, an authentication bypass, or something else entirely. The NVD listing for CVE-2026-87886 is the natural place to find that detail, and readers checking it directly should look for the vulnerability description and severity metrics rather than taking anyone’s word for how bad it is.
Crucially, there’s also no confirmed information here on how widely it’s being exploited, who’s behind it, or, perhaps most importantly for anyone trying to act on this, whether Acronis has actually shipped a patch yet. CISA’s standard advice in these cases is to follow the vendor’s own mitigation instructions, which implies a fix or workaround exists, but the brief doesn’t spell out what that fix is or when it landed.
So who is actually at risk
Acronis Backup is primarily an enterprise and IT-admin tool, it’s the kind of software used by businesses and service providers to back up servers and infrastructure, not something most home users have knowingly installed. If you’re an ordinary reader with a laptop, this almost certainly isn’t your bug. The people who need to move fast are IT teams running Acronis Backup infrastructure, particularly anyone in or adjacent to US federal government networks, where the CISA deadline actually carries binding force under BOD 22-01 mandates.
Everyone else, UK businesses, managed service providers, and anyone administering Acronis deployments outside US federal scope, isn’t legally bound by the CISA deadline, but the underlying logic doesn’t stop at a border. If it’s confirmed as actively exploited against US targets, there’s no reason to assume attackers will politely leave UK-based Acronis installs alone.
What to do about it
If your organisation runs Acronis Backup, the sensible move is to check Acronis’s own advisories directly for a patch or mitigation and apply it without waiting for a UK-specific mandate, there isn’t one. If you’re not running Acronis Backup in any enterprise or admin capacity, there’s nothing to action here.
The takeaway
This is a real, government-confirmed case of active exploitation, and it deserves attention from the specific slice of IT admins who run this software. But the public detail is currently sparse, no severity score, no technical breakdown, no clarity on ransomware involvement. Treat the urgency as genuine, and treat the specifics as still filling in.