CVE-2026-86400
CriticalCVSS 9.8Summary
Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.
Risk Assessment
This is a critical severity vulnerability — an unauthenticated remote attacker can gain full control of the backup appliance, risking data theft or destruction and further lateral movement.
Recommendation
Upgrade to the latest patched version as soon as possible as recommended by the vendor, and limit the appliance's network exposure.
Other vulnerabilities in Dell PowerProtect Data Domain
See all- CVE-2026-92665Medium
Dell PowerProtect Data Domain contains an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to denial of service.
- CVE-2026-86394High
Dell PowerProtect Data Domain contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.
- CVE-2026-86393High
Dell PowerProtect Data Domain contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-86392Medium
Dell PowerProtect Data Domain contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to denial of service.
- CVE-2026-86390Medium
Dell PowerProtect Data Domain contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- CVE-2026-86389High
Dell PowerProtect Data Domain contains an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to code execution.
- CVE-2026-86388Medium
Dell PowerProtect Data Domain contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for the attacker.
- CVE-2026-86385High
Dell PowerProtect Data Domain contains an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-86383Medium
Dell PowerProtect Data Domain contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
- CVE-2026-86380High
Dell PowerProtect Data Domain contains an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to protection mechanism bypass.
Original NVD description (English source)
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

