CVE-2026-86390 in PowerProtect Data Domain
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Dell PowerProtect Data Domain systems across multiple software release tracks including Feature Release versions 7.7.1.0 through 8.8 and specific Long Term Support releases such as LTS2024 version 7.13.1.0 through 7.13.1.80, LTS2025 version 8.3.1.0 through 8.3.1.40, and LTS2026 version 8.6.1.0 through 8.6.1.20. This vulnerability is classified as a Missing Authorization issue, which fundamentally represents a failure in the application logic to enforce proper access control policies on specific functions or resources. In this context, the system fails to verify whether an authenticated user possesses the necessary privileges before executing sensitive operations or exposing confidential data structures. The core technical flaw lies in the absence of adequate checks within the backend API endpoints or management interfaces that handle administrative tasks, allowing requests from users with lower privilege levels to bypass intended restrictions and perform actions reserved for higher-privileged administrators.
From a threat modeling perspective, this vulnerability enables an attacker who has already obtained remote access credentials with low-level privileges to escalate their influence over the system. The operational impact of such unauthorized access can be severe in enterprise backup environments where Data Domain appliances serve as critical repositories for organizational data integrity and disaster recovery capabilities. An adversary exploiting this flaw could potentially modify configuration settings, alter retention policies, delete or corrupt backed-up datasets, or extract sensitive information that should remain restricted to senior administrators. This compromises the confidentiality, integrity, and availability of the stored backup data, which directly undermines the organization's ability to recover from ransomware attacks or other catastrophic events. The risk is particularly acute because low-privileged accounts are often more numerous and potentially easier for attackers to compromise through phishing or credential stuffing compared to high-level administrative accounts.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-269, which describes Improper Privilege Control where a process operates without the necessary privileges required by its intended function. Furthermore, in terms of adversary tactics, this exploitation path corresponds to MITRE ATT&CK technique T1078 Valid Accounts, specifically involving legitimate but misused accounts with insufficient privilege separation. Attackers often leverage such weaknesses after initial access is established via other means, using them to move laterally or escalate privileges within the network infrastructure. The lack of strict authorization checks allows for unauthorized modification of system parameters that govern data protection workflows, potentially leading to denial of service conditions if critical backup jobs are disrupted or configuration files are corrupted beyond recovery without proper administrative intervention.
To mitigate this risk, organizations must immediately apply the vendor-provided software patches and updates released by Dell Technologies for all affected versions listed in the advisory. It is imperative that system administrators verify their current firmware version against the supported release matrix to ensure they are not running vulnerable code. In addition to patching, implementing strict network segmentation policies can help limit remote access to these management interfaces only from trusted IP ranges and administrative workstations. Enforcing multi-factor authentication for all user accounts, regardless of privilege level, adds a critical layer of defense against credential theft that could lead to exploitation of this authorization flaw. Regular auditing of user activity logs should also be conducted to detect any anomalous behavior indicative of unauthorized access attempts or successful exploitation events.