---
id: "CVE-2026-86380"
kind: "vulnerability"
aliases: ["CVE-2026-86380"]
title: "Dell PowerProtect Data Domain: integer overflow lets privileged user bypass protection"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup", "data-domain", "dell", "enterprise-storage", "infrastructure", "powerprotect"]
not_affected_if: ["no-remote-admin-access", "patched-release"]
published_at: "2026-10-28T10:17:09+00:00"
first_seen_at: "2026-10-28T10:32:15+00:00"
updated_at: "2026-10-28T10:34:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86380", "first_seen_at": "2026-10-28T10:32:15+00:00"}]
---

# Dell PowerProtect Data Domain: integer overflow lets privileged user bypass protection

Several Dell PowerProtect Data Domain feature and LTS releases contain an integer overflow or wraparound flaw. A high-privileged remote attacker could exploit it to bypass a protection mechanism.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DD OS version on the Data Domain system (unknown exact command from sources)
- Compare against affected ranges: `7.7.1.0` through `8.8`, `7.13.1.0` through `7.13.1.80`, `8.3.1.0` through `8.3.1.40`, `8.6.1.0` through `8.6.1.20`

## Fix

- Move to a fixed Data Domain OS release from Dell's advisory (fixed version unknown from sources)
- Restrict remote administrative access to trusted networks in the meantime

## Timeline

- 2026-10-28T10:32:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86380

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_