{"id":"CVE-2026-86395","kind":"vulnerability","aliases":["CVE-2026-86395"],"related":[],"title":"Dell PowerProtect Data Domain Virtual Edition: OS command injection enables command execution","description":"Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","summary":"Dell PowerProtect Data Domain Virtual Edition contains an OS command injection flaw across several feature and LTS release lines. A high-privileged remote attacker can run commands on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","virtual-appliance"],"not_affected_if":["release-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain Virtual Edition release against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm which accounts hold high privileges on the appliance and whether remote administrative access is exposed","fix":"- Move Data Domain Virtual Edition to a release outside the affected ranges, per the Dell advisory (version unknown from sources)\n- Restrict remote administrative access to the appliance until patched","status":"open","published_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:04+00:00","updated_at":"2026-10-28T09:34:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain Virtual Edition to a release outside the affected ranges, per the Dell advisory (version unknown from sources)\n- Restrict remote administrative access to the appliance until patched","reach":"network","title":"Dell PowerProtect Data Domain Virtual Edition: OS command injection enables command execution","impact":"high","summary":"Dell PowerProtect Data Domain Virtual Edition contains an OS command injection flaw across several feature and LTS release lines. A high-privileged remote attacker can run commands on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","virtual-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges runs arbitrary OS commands on the appliance.","analyst_note":"Find the Dell security advisory for CVE-2026-86395 to get the fixed release versions and any workaround.","how_to_check":"- Check the installed Data Domain Virtual Edition release against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm which accounts hold high privileges on the appliance and whether remote administrative access is exposed","needs_analyst":true,"not_affected_if":["release-outside-affected-ranges"],"who_is_affected":"Operators running Dell PowerProtect Data Domain Virtual Edition in the listed affected release ranges. The flaw needs a high-privileged account with remote access, so appliances with tightly controlled admin access are at lower risk, but the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":3433,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86395':15A,18A '7.13.1.0':75C '7.13.1.80':77C '7.7.1.0':69C '8.3.1.0':81C '8.3.1.40':83C '8.6.1.0':87C '8.6.1.20':89C '8.8':71C 'access':112C 'across':41B 'applianc':28B,59B 'attack':53B,109C 'backup':19B 'command':8A,11A,38B,56B,101C,103C,120C 'contain':35B,90C 'could':113C 'cve':13A,16A 'data':3A,21B,31B,62C 'data-domain':20B 'dell':1A,23B,29B,60C 'domain':4A,22B,32B,63C 'edit':6A,34B,65C 'element':96C 'enabl':10A 'execut':12A,121C 'exploit':115C 'featur':43B,66C 'flaw':40B 'high':50B,107C 'high-privileg':49B 'improp':92C 'infrastructur':24B 'inject':9A,39B,104C 'lead':118C 'line':47B 'lts':45B 'lts2024':72C 'lts2025':78C 'lts2026':84C 'neutral':93C 'os':7A,37B,100C,102C 'potenti':114C 'powerprotect':2A,25B,30B,61C 'privileg':51B,108C 'releas':46B,67C,73C,79C,85C 'remot':52B,111C 'run':55B 'sever':42B 'special':95C 'use':97C 'version':68C,74C,80C,86C 'virtual':5A,27B,33B,64C 'virtual-appli':26B 'vulner':105C,117C","nicknames":[],"mitigations":[],"who_affected":"Operators running Dell PowerProtect Data Domain Virtual Edition in the listed affected release ranges. The flaw needs a high-privileged account with remote access, so appliances with tightly controlled admin access are at lower risk, but the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86395","severity":null,"published_at":"2026-10-28T09:17:07+00:00","modified_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}