{"id":"CVE-2026-86386","kind":"vulnerability","aliases":["CVE-2026-86386"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to low-privilege users","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.","summary":"Dell PowerProtect Data Domain Management Center has an SQL injection flaw in several release lines, including Feature Release 7.7.1.0 through 8.8 and the LTS2024, LTS2025 and LTS2026 branches. An attacker with low privileges and remote access can exploit it to read information from the database.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","sql-injection"],"not_affected_if":["version-outside-listed-ranges"],"how_to_check":"- Check the installed Management Center version in the appliance UI or CLI and compare it with the affected ranges in the description.\n- unknown for any other check; the sources do not describe a specific file or setting.","fix":"- Move to a fixed release from Dell's advisory for the affected branch; the fixed version numbers are unknown from the sources.\n- unknown for any interim mitigation.","status":"open","published_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:35+00:00","updated_at":"2026-10-28T10:34:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T10:34:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release from Dell's advisory for the affected branch; the fixed version numbers are unknown from the sources.\n- unknown for any interim mitigation.","reach":"network","title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to low-privilege users","impact":"low","summary":"Dell PowerProtect Data Domain Management Center has an SQL injection flaw in several release lines, including Feature Release 7.7.1.0 through 8.8 and the LTS2024, LTS2025 and LTS2026 branches. An attacker with low privileges and remote access can exploit it to read information from the database.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","sql-injection"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged remote user reads database contents","analyst_note":"Check Dell's security advisory for fixed versions and the exact data exposed; the NVD entry alone does not give them.","how_to_check":"- Check the installed Management Center version in the appliance UI or CLI and compare it with the affected ranges in the description.\n- unknown for any other check; the sources do not describe a specific file or setting.","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges"],"who_is_affected":"Teams that run Dell PowerProtect Data Domain Management Center in the affected version ranges are exposed, and the attacker needs a low-privilege account with remote access. Systems on versions outside the listed ranges are not affected according to the description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3430,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-86386':18A,21A '7.13.1.0':92C '7.13.1.80':94C '7.7.1.0':50B,86C '8.3.1.0':98C '8.3.1.40':100C '8.6.1.0':104C '8.6.1.20':106C '8.8':52B,88C 'access':67B,128C 'attack':61B,125C 'backup':22B 'branch':59B 'center':6A,37B,82C 'command':118C 'contain':107C 'could':129C 'cve':16A,19A 'data':3A,24B,34B,79C 'data-domain':23B 'databas':76B 'dell':1A,26B,32B,77C 'disclosur':137C 'domain':4A,25B,35B,80C 'element':113C 'exploit':69B,131C 'featur':48B,83C 'flaw':42B 'improp':109C 'includ':47B 'inform':10A,73B,136C 'infrastructur':27B 'inject':8A,31B,41B,120C 'lead':134C 'leak':9A 'line':46B 'low':13A,63B,123C 'low-privileg':12A 'lts2024':55B,89C 'lts2025':56B,95C 'lts2026':58B,101C 'manag':5A,36B,81C 'neutral':110C 'potenti':130C 'powerprotect':2A,28B,33B,78C 'privileg':14A,64B,124C 'read':72B 'releas':45B,49B,84C,90C,96C,102C 'remot':66B,127C 'sever':44B 'special':112C 'sql':7A,30B,40B,117C,119C 'sql-inject':29B 'use':114C 'user':15A 'version':85C,91C,97C,103C 'vulner':121C,133C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dell PowerProtect Data Domain Management Center in the affected version ranges are exposed, and the attacker needs a low-privilege account with remote access. Systems on versions outside the listed ranges are not affected according to the description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86386","severity":null,"published_at":"2026-10-28T10:17:09+00:00","modified_at":"2026-10-28T10:17:09+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}