{"id":"CVE-2026-86385","kind":"vulnerability","aliases":["CVE-2026-86385"],"related":[],"title":"Dell PowerProtect Data Domain: low-privileged user can escalate privileges remotely","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.","summary":"Dell PowerProtect Data Domain feature releases 7.7.1.0 through 8.8 fail to check whether privileges were properly dropped. A low-privileged attacker with remote access could exploit this to gain elevated privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","on-prem","powerprotect"],"not_affected_if":["no-remote-low-privilege-access","unsupported-release-outside-range"],"how_to_check":"- Check the installed Data Domain OS version against the affected range 7.7.1.0 through 8.8 (unknown exact command; see Dell advisory)\n- Confirm whether a low-privileged account on the system is reachable remotely: unknown","fix":"- Move Data Domain OS to a release outside the affected range 7.7.1.0 through 8.8, per Dell's advisory: unknown fixed version\n- Apply the Dell security update for PowerProtect Data Domain once published: unknown","status":"open","published_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:22+00:00","updated_at":"2026-10-28T10:34:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T10:34:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a release outside the affected range 7.7.1.0 through 8.8, per Dell's advisory: unknown fixed version\n- Apply the Dell security update for PowerProtect Data Domain once published: unknown","reach":"network","title":"Dell PowerProtect Data Domain: low-privileged user can escalate privileges remotely","impact":"high","summary":"Dell PowerProtect Data Domain feature releases 7.7.1.0 through 8.8 fail to check whether privileges were properly dropped. A low-privileged attacker with remote access could exploit this to gain elevated privileges.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","on-prem"],"confidence":0.5,"needs_auth":"yes","worst_case":"A low-privileged remote user gains elevated privileges on the appliance.","analyst_note":"Find the Dell security advisory for CVE-2026-86385 to get the fixed version, the exact affected builds, and any workaround; the NVD entry alone lacks these.","how_to_check":"- Check the installed Data Domain OS version against the affected range 7.7.1.0 through 8.8 (unknown exact command; see Dell advisory)\n- Confirm whether a low-privileged account on the system is reachable remotely: unknown","needs_analyst":true,"not_affected_if":["unsupported-release-outside-range","no-remote-low-privilege-access"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain feature releases from 7.7.1.0 through 8.8 with remote access enabled for low-privileged accounts. Systems on other releases, or without remotely reachable low-privileged accounts, are less exposed. Sources do not say which specific features or configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3327,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86385':15A,18A '7.7.1.0':35B,68C '8.8':37B,70C 'access':53B,85C 'attack':50B,82C 'backup':19B 'check':40B,74C 'contain':71C 'could':54B,86C 'cve':13A,16A 'data':3A,21B,31B,63C 'data-domain':20B 'dell':1A,23B,29B,61C 'domain':4A,22B,32B,64C 'drop':45B,76C 'elev':59B,93C 'escal':10A 'exploit':55B,88C 'fail':38B 'featur':33B,65C 'gain':58B 'improp':73C 'infrastructur':24B 'lead':91C 'low':6A,48B,80C 'low-privileg':5A,47B 'on-prem':25B 'potenti':87C 'powerprotect':2A,28B,30B,62C 'prem':27B 'privileg':7A,11A,42B,49B,60B,77C,81C,95C 'proper':44B 'releas':34B,66C 'remot':12A,52B,84C 'user':8A 'version':67C 'vulner':78C,90C 'whether':41B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain feature releases from 7.7.1.0 through 8.8 with remote access enabled for low-privileged accounts. Systems on other releases, or without remotely reachable low-privileged accounts, are less exposed. Sources do not say which specific features or configurations are required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86385","severity":null,"published_at":"2026-10-28T10:17:09+00:00","modified_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}