CVE-2026-86399: OS Command Injection

Q: Who can exploit this issue?

Exploitation requires a high-privileged attacker with remote access to an affected Dell PowerProtect Data Domain system. The attack complexity is low and no user interaction is required.

Q: What impact could successful exploitation have?

A successful exploit could allow OS command execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.

Q: Which releases are affected?

Affected releases are Feature Release 7.7.1.0 through 8.8; LTS2024 7.13.1.0 through 7.13.1.80; LTS2025 8.3.1.0 through 8.3.1.40; and LTS2026 8.6.1.0 through 8.6.1.20.

Published Oct 28, 2026

Updated

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Affected Software

1 affected component

Dell PowerProtect Data Domain>=7.7.1.0<=8.8, >=7.13.1.0<=7.13.1.80, >=8.3.1.0<=8.3.1.40, >=8.6.1.0<=8.6.1.20

Event History

Oct 28, 2026

CVE Published

via MITRE·08:54 AM

Data Sourced

via MITRE·08:54 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a high-privileged attacker with remote access to an affected Dell PowerProtect Data Domain system. The attack complexity is low and no user interaction is required.

What impact could successful exploitation have?

A successful exploit could allow OS command execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.

Which releases are affected?