---
id: "CVE-2026-86384"
kind: "vulnerability"
aliases: ["CVE-2026-86384"]
title: "Dell PowerProtect Data Domain: hard-coded crypto key exposes credentials remotely"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect", "self-hosted"]
not_affected_if: ["version-outside-affected-range"]
published_at: "2026-10-28T10:17:09+00:00"
first_seen_at: "2026-10-28T10:32:15+00:00"
updated_at: "2026-10-28T10:34:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86384", "first_seen_at": "2026-10-28T10:32:15+00:00"}]
---

# Dell PowerProtect Data Domain: hard-coded crypto key exposes credentials remotely

Dell PowerProtect Data Domain appliances ship with a hard-coded cryptographic key in several feature and LTS release lines. An unauthenticated attacker with remote access can potentially expose stored credentials and use them with the privileges of the compromised user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature 7.7.1.0 through 8.8; LTS2024 7.13.1.0 through 7.13.1.80; LTS2025 8.3.1.0 through 8.3.1.40; LTS2026 8.6.1.0 through 8.6.1.20).

## Fix

- Move Data Domain OS to a release outside the affected ranges, per the Dell security advisory (fixed version: unknown from the sources).

## Timeline

- 2026-10-28T10:32:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86384

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_