---
id: "CVE-2026-86378"
kind: "vulnerability"
aliases: ["CVE-2026-86378"]
title: "Dell PowerProtect Data Domain: stack overflow lets low-privilege remote users gain access"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup", "data-domain", "dell", "infrastructure", "on-prem", "powerprotect"]
not_affected_if: ["no-remote-access", "unaffected-release"]
published_at: "2026-10-28T11:17:26+00:00"
first_seen_at: "2026-10-28T11:32:33+00:00"
updated_at: "2026-10-28T11:33:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86378", "first_seen_at": "2026-10-28T11:32:33+00:00"}]
---

# Dell PowerProtect Data Domain: stack overflow lets low-privilege remote users gain access

Several Dell PowerProtect Data Domain release lines contain a stack-based buffer overflow. A low-privileged attacker with remote access could exploit it to gain unauthorized access to the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version on the appliance (unknown exact command from sources)
- Compare against affected ranges: 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), 8.6.1.0 through 8.6.1.20 (LTS2026)

## Fix

- Move Data Domain OS to a fixed release from Dell's advisory (fixed version unknown from sources)
- Restrict remote management access to the appliance to trusted networks until patched

## Timeline

- 2026-10-28T11:32:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86378

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_