CVE-2026-86386: SQL Injection

Q: Who is realistically exposed to exploitation?

Deployments running one of the listed Feature Release, LTS2024, LTS2025, or LTS2026 version ranges are exposed if a low-privileged attacker has remote access to the management center.

Q: What level of access does an attacker need?

The attacker needs remote access and low-privileged access. No user interaction is required, and the vulnerability can disclose information; integrity and availability impacts are not indicated.

Published Oct 28, 2026

Updated

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Affected Software

1 affected component

Dell Powerprotect Data Domain Management Center>=7.7.1.0<=8.8, >=7.13.1.0<=7.13.1.80, >=8.3.1.0<=8.3.1.40, >=8.6.1.0<=8.6.1.20

Event History

Oct 28, 2026

CVE Published

via MITRE·09:44 AM

Data Sourced

via MITRE·09:44 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to exploitation?

Deployments running one of the listed Feature Release, LTS2024, LTS2025, or LTS2026 version ranges are exposed if a low-privileged attacker has remote access to the management center.

What level of access does an attacker need?