Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-86400: Dell PowerProtect Data Domain allows remote attacker to run commands
CVE-2026-86400 · published 5 days ago
Summary
Versions of Dell PowerProtect Data Domain from 7.7.1.0 up to the latest LTS releases can be accessed without proper login checks. An attacker who can reach the system over the network could execute any command they want with full administrator rights, effectively taking control of the appliance. Dell advises applying the latest software updates as soon as possible to fix this issue.
What to do
- Update dell powerprotect data domain to version 8.9.0.0 or later or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dell | powerprotect data domain | < 8.9.0.0 or later |
Original advisory text
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ...
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-287Improper Authentication
Timeline
Published28 Oct 2026
Updated31 Oct 2026
First seen28 Oct 2026
Track software like this
Free during beta