---
id: "CVE-2026-86392"
kind: "vulnerability"
aliases: ["CVE-2026-86392"]
title: "Dell PowerProtect Data Domain: heap overflow lets a privileged remote user crash service"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect"]
not_affected_if: ["no-remote-admin-access", "version-outside-listed-ranges"]
published_at: "2026-10-28T10:17:10+00:00"
first_seen_at: "2026-10-28T10:32:15+00:00"
updated_at: "2026-10-28T10:34:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86392", "first_seen_at": "2026-10-28T10:32:15+00:00"}]
---

# Dell PowerProtect Data Domain: heap overflow lets a privileged remote user crash service

Several Dell PowerProtect Data Domain release lines contain a heap-based buffer overflow. A high-privileged attacker with remote access can trigger it to cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges in the Dell advisory (7.7.1.0 through 8.8 feature releases, 7.13.1.0 to 7.13.1.80, 8.3.1.0 to 8.3.1.40, 8.6.1.0 to 8.6.1.20)
- unknown for any other check, as the sources do not say

## Fix

- Upgrade Dell PowerProtect Data Domain to a fixed release listed in the Dell security advisory for your release line
- unknown for the exact fixed version numbers, as the sources do not say

## Timeline

- 2026-10-28T10:32:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86392

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_