CVE-2026-86397 in PowerProtect Data Domain
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Dell PowerProtect Data Domain systems across multiple software release tracks including Feature Releases 7.7.1.0 through 8.8, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20. This vulnerability is classified as an Improper Authentication issue which fundamentally undermines the integrity of access control mechanisms within the appliance management interface or backend services. The core technical deficiency involves a failure to properly validate credentials or session tokens during specific administrative operations, allowing actors who have network reachability to bypass standard authentication protocols. In enterprise storage environments such as Data Domain, where centralized management and automated backup workflows are critical, this architectural weakness presents a severe risk vector for unauthorized system manipulation.
From an operational perspective, the exploitation of this vulnerability enables an unauthenticated attacker with remote access capabilities to create privileged accounts on the target system. This action effectively grants the adversary full administrative control over the storage infrastructure without requiring valid user credentials or multi-factor authentication tokens. The ability to establish new high-privilege sessions allows for comprehensive modification of system configurations, alteration of backup policies, and potential exfiltration or encryption of stored data. Given that Data Domain appliances often serve as primary repositories for critical organizational data, this level of access compromises not only the confidentiality and integrity of the stored information but also the availability of business-critical operations dependent on these storage resources.
The severity rating of Critical is warranted due to the direct impact on system sovereignty and data security posture. An attacker leveraging this flaw can achieve persistent administrative presence within the network segment hosting the Data Domain appliance. This aligns with Common Weakness Enumeration category CWE-287 which describes Improper Authentication, specifically highlighting scenarios where authentication logic fails or is bypassed. Furthermore, the capability to create privileged accounts maps directly to MITRE ATT&CK technique T1136.001 titled Create Account: Local Account. This tactic allows adversaries to maintain long-term access and escalate privileges within the environment, facilitating further lateral movement or ransomware deployment against connected systems that rely on this storage infrastructure for backups.
To mitigate this risk, immediate action is required by upgrading all affected Dell PowerProtect Data Domain appliances to a patched version as recommended by Dell Technologies. Organizations should prioritize patching efforts based on asset criticality and exposure level, ensuring that management interfaces are not unnecessarily exposed to untrusted networks. In addition to software updates, implementing strict network segmentation policies for storage management planes can reduce the attack surface available to remote attackers. Security teams should also monitor for anomalous account creation events or unexpected administrative logins as indicators of potential exploitation attempts while patching operations are underway.