{"id":"CVE-2026-86390","kind":"vulnerability","aliases":["CVE-2026-86390"],"related":[],"title":"Dell PowerProtect Data Domain: missing authorization lets low-privileged users gain access","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.","summary":"Several Dell PowerProtect Data Domain feature and LTS release lines contain a missing authorization check. A low-privileged attacker with remote access could reach functions they should not and gain unauthorized access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Identify the installed Data Domain OS version on each appliance (unknown exact command in sources)\n- Compare against affected ranges: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, 8.6.1.0 through 8.6.1.20","fix":"- Move to a fixed release from Dell's security advisory for the Data Domain OS line in use (fixed version numbers: unknown in sources)","status":"open","published_at":"2026-10-28T10:17:10+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:31+00:00","updated_at":"2026-10-28T10:34:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T10:34:31Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release from Dell's security advisory for the Data Domain OS line in use (fixed version numbers: unknown in sources)","reach":"network","title":"Dell PowerProtect Data Domain: missing authorization lets low-privileged users gain access","impact":"medium","summary":"Several Dell PowerProtect Data Domain feature and LTS release lines contain a missing authorization check. A low-privileged attacker with remote access could reach functions they should not and gain unauthorized access.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privileged remote user gains unauthorized access to protected functions","analyst_note":"Find Dell's security advisory for CVE-2026-86390 to confirm fixed versions and the exact affected functions.","how_to_check":"- Identify the installed Data Domain OS version on each appliance (unknown exact command in sources)\n- Compare against affected ranges: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, 8.6.1.0 through 8.6.1.20","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed feature or LTS release ranges, where remote low-privileged accounts exist. Systems on versions outside the listed ranges are not in scope per the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3409,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86390':16A,19A '7.13.1.0':76C '7.13.1.80':78C '7.7.1.0':70C '8.3.1.0':82C '8.3.1.40':84C '8.6.1.0':88C '8.6.1.20':90C '8.8':72C 'access':13A,52B,62B,102C,111C 'attack':49B,99C 'author':6A,43B,94C 'backup':20B 'check':44B 'contain':40B,91C 'could':53B,103C 'cve':14A,17A 'data':3A,22B,33B,65C 'data-domain':21B 'dell':1A,24B,31B,63C 'domain':4A,23B,34B,66C 'exploit':105C 'featur':35B,67C 'function':55B 'gain':12A,60B 'host':29B 'infrastructur':25B 'lead':108C 'let':7A 'line':39B 'low':9A,47B,97C 'low-privileg':8A,46B 'lts':37B 'lts2024':73C 'lts2025':79C 'lts2026':85C 'miss':5A,42B,93C 'potenti':104C 'powerprotect':2A,26B,32B,64C 'privileg':10A,48B,98C 'reach':54B 'releas':38B,68C,74C,80C,86C 'remot':51B,101C 'self':28B 'self-host':27B 'sever':30B 'unauthor':61B,110C 'user':11A 'version':69C,75C,81C,87C 'vulner':95C,107C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed feature or LTS release ranges, where remote low-privileged accounts exist. Systems on versions outside the listed ranges are not in scope per the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86390","severity":null,"published_at":"2026-10-28T10:17:10+00:00","modified_at":"2026-10-28T10:17:10+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}