---
id: "CVE-2026-86389"
kind: "vulnerability"
aliases: ["CVE-2026-86389"]
title: "Dell PowerProtect Data Domain: integer overflow lets privileged attacker run code"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect"]
not_affected_if: ["no-remote-admin-access", "other-release-lines"]
published_at: "2026-10-28T10:17:10+00:00"
first_seen_at: "2026-10-28T10:32:15+00:00"
updated_at: "2026-10-28T10:34:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86389", "first_seen_at": "2026-10-28T10:32:15+00:00"}]
---

# Dell PowerProtect Data Domain: integer overflow lets privileged attacker run code

Several Dell PowerProtect Data Domain release lines contain an integer overflow or wraparound bug. A high-privileged attacker with remote access could exploit it to execute code on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges: 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), 8.6.1.0 through 8.6.1.20 (LTS2026)
- unknown for any other check, the sources do not say

## Fix

- Move Data Domain OS to a release outside the affected ranges, per Dell's advisory
- unknown for the exact fixed version numbers, the sources do not say

## Timeline

- 2026-10-28T10:32:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86389

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_