{"id":"CVE-2026-86396","kind":"vulnerability","aliases":["CVE-2026-86396"],"related":[],"title":"Dell PowerProtect Data Domain: OS command injection lets low-privileged users run commands","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.","summary":"Several Dell PowerProtect Data Domain feature and LTS release lines contain an OS command injection flaw. A low-privileged attacker with remote access can exploit it to run commands on the appliance.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["remote-access-restricted","version-outside-range"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.\n- Confirm the vendor advisory for the exact fixed build; the sources do not list it.","fix":"- Move Data Domain OS to a fixed release from Dell's advisory for CVE-2026-86396 (fixed version: unknown in the sources).\n- Restrict remote administrative access to the appliance until patched.","status":"open","published_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:04+00:00","updated_at":"2026-10-28T09:34:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T09:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a fixed release from Dell's advisory for CVE-2026-86396 (fixed version: unknown in the sources).\n- Restrict remote administrative access to the appliance until patched.","reach":"network","title":"Dell PowerProtect Data Domain: OS command injection lets low-privileged users run commands","impact":"high","summary":"Several Dell PowerProtect Data Domain feature and LTS release lines contain an OS command injection flaw. A low-privileged attacker with remote access can exploit it to run commands on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs OS commands on the backup appliance","analyst_note":"Check Dell's security advisory for the fixed build numbers and whether a workaround exists; the sources give only NVD text.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.\n- Confirm the vendor advisory for the exact fixed build; the sources do not list it.","needs_analyst":true,"not_affected_if":["version-outside-range","remote-access-restricted"],"who_is_affected":"Only Data Domain appliances running the listed release ranges are affected. The flaw requires a low-privileged account with remote access, so systems where remote management is limited to trusted administrators have a smaller exposure. Teams running other PowerProtect products or outside the listed versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":3428,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-86396':17A,20A '7.13.1.0':76C '7.13.1.80':78C '7.7.1.0':70C '8.3.1.0':82C '8.3.1.40':84C '8.6.1.0':88C '8.6.1.20':90C '8.8':72C 'access':53B,113C 'applianc':23B,62B 'attack':50B,110C 'backup':22B 'backup-appli':21B 'command':6A,14A,43B,59B,102C,104C,121C 'contain':40B,91C 'could':114C 'cve':15A,18A 'data':3A,25B,33B,65C 'data-domain':24B 'dell':1A,27B,31B,63C 'domain':4A,26B,34B,66C 'element':97C 'execut':122C 'exploit':55B,116C 'featur':35B,67C 'flaw':45B 'improp':93C 'infrastructur':28B 'inject':7A,44B,105C 'lead':119C 'let':8A 'line':39B 'low':10A,48B,108C 'low-privileg':9A,47B 'lts':37B 'lts2024':73C 'lts2025':79C 'lts2026':85C 'neutral':94C 'os':5A,42B,101C,103C 'potenti':115C 'powerprotect':2A,29B,32B,64C 'privileg':11A,49B,109C 'releas':38B,68C,74C,80C,86C 'remot':52B,112C 'run':13A,58B 'sever':30B 'special':96C 'use':98C 'user':12A 'version':69C,75C,81C,87C 'vulner':106C,118C","nicknames":[],"mitigations":[],"who_affected":"Only Data Domain appliances running the listed release ranges are affected. The flaw requires a low-privileged account with remote access, so systems where remote management is limited to trusted administrators have a smaller exposure. Teams running other PowerProtect products or outside the listed versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86396","severity":null,"published_at":"2026-10-28T09:17:07+00:00","modified_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}