CVE Catalog

CVE-2026-86400

CriticalCVSS 9.8
Published: Translated: NVD NIST

Summary

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.

Risk Assessment

This is a critical severity vulnerability — an unauthenticated remote attacker can gain full control of the backup appliance, risking data theft or destruction and further lateral movement.

Recommendation

Upgrade to the latest patched version as soon as possible as recommended by the vendor, and limit the appliance's network exposure.

Other vulnerabilities in Dell PowerProtect Data Domain

See all
Original NVD description (English source)

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS