Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Dell PowerProtect Data Domain could expose credentials

CVE-2026-86384 · published 5 days ago
Summary

Certain versions of Dell PowerProtect Data Domain use a hard-coded encryption key, which can be discovered by an attacker who does not need to log in. This could allow the attacker to see usernames and passwords and then access the system as a legitimate user. Apply the latest security updates from Dell as soon as possible to replace the hard-coded key.

What to do
  • Update dell powerprotect data domain to version 8.9.0.0 or later or later.
Affected software
VendorProductAffected versions
dell powerprotect data domain < 8.9.0.0 or later
Original advisory text
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ...
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published28 Oct 2026
Updated29 Oct 2026
First seen28 Oct 2026
Sources
CVE-2026-86384 · NVD
CVE-2026-86384 · MITRE
Track software like this
Free during beta