{"id":"CVE-2026-86394","kind":"vulnerability","aliases":["CVE-2026-86394"],"related":[],"title":"Dell PowerProtect Data Domain: OS command injection lets a privileged user run commands","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","summary":"Several Dell PowerProtect Data Domain release lines contain an OS command injection flaw, where special characters in input reach the operating system shell. An attacker with high privileges and remote access can execute commands on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["no-data-domain-appliance","no-remote-admin-access","versions-outside-listed-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20).\n- Check which accounts hold high privileges on the appliance and who can reach its management interface remotely.","fix":"- Move Dell PowerProtect Data Domain to a fixed release from Dell's advisory for your release line; the sources do not list the fixed version numbers, so unknown.\n- Restrict remote management access to the appliance to trusted networks while the update is pending.","status":"open","published_at":"2026-10-28T10:17:10+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:22+00:00","updated_at":"2026-10-28T10:34:22+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T10:34:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move Dell PowerProtect Data Domain to a fixed release from Dell's advisory for your release line; the sources do not list the fixed version numbers, so unknown.\n- Restrict remote management access to the appliance to trusted networks while the update is pending.","reach":"network","title":"Dell PowerProtect Data Domain: OS command injection lets a privileged user run commands","impact":"high","summary":"Several Dell PowerProtect Data Domain release lines contain an OS command injection flaw, where special characters in input reach the operating system shell. An attacker with high privileges and remote access can execute commands on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs operating system commands on the backup appliance.","analyst_note":"Find Dell's security advisory for CVE-2026-86394 to get the fixed versions and any workaround; the NVD entry alone does not give them.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20).\n- Check which accounts hold high privileges on the appliance and who can reach its management interface remotely.","needs_analyst":true,"not_affected_if":["no-data-domain-appliance","versions-outside-listed-ranges","no-remote-admin-access"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on one of the listed release lines are affected. Exploitation needs a high-privileged account with remote access, so systems where management access is limited to a few administrators carry less risk. Teams not running Data Domain appliances can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":3429,"output_tokens":720,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86394':16A,19A '7.13.1.0':82C '7.13.1.80':84C '7.7.1.0':76C '8.3.1.0':88C '8.3.1.40':90C '8.6.1.0':94C '8.6.1.20':96C '8.8':78C 'access':62B,119C 'applianc':22B,68B 'attack':56B,116C 'backup':21B 'backup-appli':20B 'charact':47B 'command':6A,13A,42B,65B,108C,110C,127C 'contain':39B,97C 'could':120C 'cve':14A,17A 'data':3A,24B,35B,71C 'data-domain':23B 'dell':1A,26B,33B,69C 'domain':4A,25B,36B,72C 'element':103C 'execut':64B,128C 'exploit':122C 'featur':73C 'flaw':44B 'high':58B,114C 'host':31B 'improp':99C 'infrastructur':27B 'inject':7A,43B,111C 'input':49B 'lead':125C 'let':8A 'line':38B 'lts2024':79C 'lts2025':85C 'lts2026':91C 'neutral':100C 'oper':52B 'os':5A,41B,107C,109C 'potenti':121C 'powerprotect':2A,28B,34B,70C 'privileg':10A,59B,115C 'reach':50B 'releas':37B,74C,80C,86C,92C 'remot':61B,118C 'run':12A 'self':30B 'self-host':29B 'sever':32B 'shell':54B 'special':46B,102C 'system':53B 'use':104C 'user':11A 'version':75C,81C,87C,93C 'vulner':112C,124C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on one of the listed release lines are affected. Exploitation needs a high-privileged account with remote access, so systems where management access is limited to a few administrators carry less risk. Teams not running Data Domain appliances can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86394","severity":null,"published_at":"2026-10-28T10:17:10+00:00","modified_at":"2026-10-28T10:17:10+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}