{"id":"CVE-2026-86384","kind":"vulnerability","aliases":["CVE-2026-86384"],"related":[],"title":"Dell PowerProtect Data Domain: hard-coded crypto key exposes credentials remotely","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.","summary":"Dell PowerProtect Data Domain appliances ship with a hard-coded cryptographic key in several feature and LTS release lines. An unauthenticated attacker with remote access can potentially expose stored credentials and use them with the privileges of the compromised user.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["version-outside-affected-range"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature 7.7.1.0 through 8.8; LTS2024 7.13.1.0 through 7.13.1.80; LTS2025 8.3.1.0 through 8.3.1.40; LTS2026 8.6.1.0 through 8.6.1.20).","fix":"- Move Data Domain OS to a release outside the affected ranges, per the Dell security advisory (fixed version: unknown from the sources).","status":"open","published_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:22+00:00","updated_at":"2026-10-28T10:34:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T10:34:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a release outside the affected ranges, per the Dell security advisory (fixed version: unknown from the sources).","reach":"network","title":"Dell PowerProtect Data Domain: hard-coded crypto key exposes credentials remotely","impact":"high","summary":"Dell PowerProtect Data Domain appliances ship with a hard-coded cryptographic key in several feature and LTS release lines. An unauthenticated attacker with remote access can potentially expose stored credentials and use them with the privileges of the compromised user.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads credentials and acts as the compromised user on the appliance.","analyst_note":"Fixed versions and the Dell advisory URL are not in the sources; find the Dell PSA for CVE-2026-86384 and confirm the patched release numbers and any workaround.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature 7.7.1.0 through 8.8; LTS2024 7.13.1.0 through 7.13.1.80; LTS2025 8.3.1.0 through 8.3.1.40; LTS2026 8.6.1.0 through 8.6.1.20).","needs_analyst":true,"not_affected_if":["version-outside-affected-range"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on the affected feature or LTS release ranges, where the appliance is reachable over the network. Appliances already on a fixed release, or those not reachable from untrusted networks, are less exposed; the sources do not say which configurations are safe beyond the version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3441,"output_tokens":665,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86384':15A,18A '7.13.1.0':85C '7.13.1.80':87C '7.7.1.0':79C '8.3.1.0':91C '8.3.1.40':93C '8.6.1.0':97C '8.6.1.20':99C '8.8':81C 'access':56B,115C,131C 'applianc':21B,35B 'attack':53B,112C 'backup':20B 'backup-appli':19B 'code':7A,41B,106C 'compromis':70B,138C 'contain':100C 'could':116C 'credenti':11A,61B,123C,126C 'crypto':8A 'cryptograph':42B,107C 'cve':13A,16A 'data':3A,23B,33B,74C 'data-domain':22B 'dell':1A,25B,31B,72C 'domain':4A,24B,34B,75C 'exploit':118C 'expos':10A,59B 'exposur':124C 'featur':46B,76C 'hard':6A,40B,105C 'hard-cod':5A,39B,104C 'host':30B 'infrastructur':26B 'key':9A,43B,108C 'lead':121C 'line':50B 'lts':48B 'lts2024':82C 'lts2025':88C 'lts2026':94C 'may':127C 'potenti':58B,117C 'powerprotect':2A,27B,32B,73C 'privileg':67B,135C 'releas':49B,77C,83C,89C,95C 'remot':12A,55B,114C 'self':29B 'self-host':28B 'sever':45B 'ship':36B 'store':60B 'system':133C 'unauthent':52B,111C 'use':63B,102C,129C 'user':71B,139C 'version':78C,84C,90C,96C 'vulner':109C,120C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on the affected feature or LTS release ranges, where the appliance is reachable over the network. Appliances already on a fixed release, or those not reachable from untrusted networks, are less exposed; the sources do not say which configurations are safe beyond the version ranges.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86384","severity":null,"published_at":"2026-10-28T10:17:09+00:00","modified_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}