{"id":"CVE-2026-86377","kind":"vulnerability","aliases":["CVE-2026-86377"],"related":[],"title":"Dell PowerProtect Data Domain: out-of-bounds write lets low-privileged users crash service","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Out-of-bounds Write vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.","summary":"Several Dell PowerProtect Data Domain release lines contain an out-of-bounds write flaw. A low-privileged remote attacker can exploit it to cause a denial of service.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges in the Dell advisory: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm the exact installed version with the system's version command (unknown in the sources)","fix":"- Move Data Domain systems to a fixed release from Dell's advisory for your release line (fixed version numbers unknown in the sources)\n- Until patched, restrict remote access to the management interface to trusted networks","status":"open","published_at":"2026-10-28T11:17:26+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","triaged_at":"2026-10-28T11:33:20+00:00","updated_at":"2026-10-28T11:33:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:33:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain systems to a fixed release from Dell's advisory for your release line (fixed version numbers unknown in the sources)\n- Until patched, restrict remote access to the management interface to trusted networks","reach":"network","title":"Dell PowerProtect Data Domain: out-of-bounds write lets low-privileged users crash service","impact":"medium","summary":"Several Dell PowerProtect Data Domain release lines contain an out-of-bounds write flaw. A low-privileged remote attacker can exploit it to cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","infrastructure"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker crashes the Data Domain service, disrupting backups and restores","analyst_note":"Check Dell's security advisory for the fixed versions per release line and confirm the attack vector and privilege requirements.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges in the Dell advisory: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm the exact installed version with the system's version command (unknown in the sources)","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on any of the listed release ranges, reachable by low-privileged remote users. Systems on versions outside the listed ranges are not in scope per the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3409,"output_tokens":640,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-86377':19A,22A '7.13.1.0':73C '7.13.1.80':75C '7.7.1.0':67C '8.3.1.0':79C '8.3.1.40':81C '8.6.1.0':85C '8.6.1.20':87C '8.8':69C 'access':102C 'attack':50B,99C 'backup':23B 'bound':8A,42B,93C 'caus':55B 'contain':37B,88C 'could':103C 'crash':15A 'cve':17A,20A 'data':3A,25B,33B,62C 'data-domain':24B 'dell':1A,27B,31B,60C 'denial':57B,110C 'domain':4A,26B,34B,63C 'exploit':52B,105C 'featur':64C 'flaw':44B 'infrastructur':28B 'lead':108C 'let':10A 'line':36B 'low':12A,47B,97C 'low-privileg':11A,46B 'lts2024':70C 'lts2025':76C 'lts2026':82C 'out-of-bound':5A,39B,90C 'potenti':104C 'powerprotect':2A,29B,32B,61C 'privileg':13A,48B,98C 'releas':35B,65C,71C,77C,83C 'remot':49B,101C 'servic':16A,59B,112C 'sever':30B 'user':14A 'version':66C,72C,78C,84C 'vulner':95C,107C 'write':9A,43B,94C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on any of the listed release ranges, reachable by low-privileged remote users. Systems on versions outside the listed ranges are not in scope per the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86377","severity":null,"published_at":"2026-10-28T11:17:26+00:00","modified_at":"2026-10-28T11:17:26+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","fetched_at":"2026-10-28T11:32:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}