{"type":"bundle","id":"bundle--529880d7-fedd-5adc-9e70-56b201db5c8c","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--77c70658-0820-5a9e-8d71-a37abe211901","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:07.672451Z","modified":"2026-09-24T19:51:07.672451Z","name":"CVE-2026-87886","description":"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.","external_references":[{"source_name":"cve","external_id":"CVE-2026-87886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87886"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:07.672451Z","modified":"2026-09-24T19:51:07.672451Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--817b7dc3-ad7f-5d92-a899-3bc56c1aef25","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:07.672451Z","modified":"2026-09-24T19:51:07.672451Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--77c70658-0820-5a9e-8d71-a37abe211901"},{"type":"report","spec_version":"2.1","id":"report--951477df-5f10-576c-88df-a459ea2613b3","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:07.672451Z","modified":"2026-10-30T14:11:23.705701Z","name":"Acronis Backup CVE-2026-87886 exploited in the wild","description":"CISA lists CVE-2026-87886, a vulnerability in Acronis Backup, in the Known Exploited Vulnerabilities catalog (added 2026-09-16, due 2026-09-19), and NVD records a CVSS of 7.8. This report summarizes public CTI only.","published":"2026-09-24T19:51:07.672451Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--77c70658-0820-5a9e-8d71-a37abe211901","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","relationship--817b7dc3-ad7f-5d92-a899-3bc56c1aef25"],"confidence":90}]}