CVE-2026-86386
MediumCVSS 4.3Summary
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
Risk Assessment
An attacker could extract data from the database by injecting malicious SQL, potentially compromising information confidentiality. Exploitation requires only low privileges and network access.
Recommendation
Update Dell PowerProtect Data Domain Management Center to a patched version and restrict access to the management interface. Monitor for unusual queries and database errors.
Other vulnerabilities in Dell PowerProtect Data Domain Management Center
See all- CVE-2026-110540High
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low privileged attacker with remote access could exploit it to perform unauthorized operations.
- CVE-2026-86391Medium
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of Service.
- CVE-2026-86379High
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.
- CVE-2026-90724Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90723Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90719Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-86401Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to expose information.
- CVE-2026-103799Critical
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.
- CVE-2026-103792Critical
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.
- CVE-2026-90717Critical
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.
Original NVD description (English source)
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

