Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Dell PowerProtect Data Domain lets remote attacker create admin

CVE-2026-86397 · published 5 days ago
Summary

Versions of Dell PowerProtect Data Domain from 7.7.1.0 up to 8.6.1.20 can be accessed over the network without proper verification, allowing anyone on the internet to create a privileged account. This could give an attacker full control of the backup system. Dell advises applying the latest software updates as soon as possible.

What to do
  • Update dell powerprotect data domain to version 8.9.0.0 or later or later.
Affected software
VendorProductAffected versions
dell powerprotect data domain < 8.9.0.0 or later
Original advisory text
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ...
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published28 Oct 2026
Updated31 Oct 2026
First seen28 Oct 2026
Sources
CVE-2026-86397 · NVD
CVE-2026-86397 · MITRE
Track software like this
Free during beta