CVE-2026-86400: Critical severity Dell PowerProtect Data Domain vulnerability
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running Dell PowerProtect Data Domain Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20 are affected if an attacker has remote access to them.
Does an attacker need credentials or user interaction?
No. The vulnerability can be exploited by an unauthenticated remote attacker, and the supplied vector indicates no user interaction or privileges are required.
What is the potential impact of successful exploitation?
Successful exploitation could allow arbitrary command execution with root privileges. This can give the attacker complete control of the affected system.
What remediation is recommended?
Dell recommends upgrading affected PowerProtect Data Domain systems at the earliest opportunity.