{"id":"CVE-2026-86397","kind":"vulnerability","aliases":["CVE-2026-86397"],"related":[],"title":"Dell PowerProtect Data Domain: unauthenticated remote attacker creates privileged accounts","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.","summary":"Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. An unauthenticated remote attacker can potentially create a privileged account and take full control of the system.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges in the Dell advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Review the user account list for unexpected privileged accounts","fix":"- Upgrade Data Domain OS to the fixed release recommended by Dell (fixed version numbers: unknown)","status":"open","published_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:33:59+00:00","updated_at":"2026-10-28T09:33:59+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T09:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Data Domain OS to the fixed release recommended by Dell (fixed version numbers: unknown)","reach":"network","title":"Dell PowerProtect Data Domain: unauthenticated remote attacker creates privileged accounts","impact":"high","summary":"Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. An unauthenticated remote attacker can potentially create a privileged account and take full control of the system.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker creates privileged account and gains complete control of the appliance","analyst_note":"Fixed version numbers and Dell advisory URL are not in the sources; find the Dell security advisory for CVE-2026-86397 to confirm fixed releases and any workaround.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges in the Dell advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Review the user account list for unexpected privileged accounts","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Teams running Dell PowerProtect Data Domain appliances on the listed affected release lines that accept remote access from the network. The sources do not describe a non-default configuration that is required for exposure. Systems on versions outside the listed ranges are not affected per the description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00067,"input_tokens":3462,"output_tokens":648,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86397':13A,16A '7.13.1.0':76C '7.13.1.80':78C '7.7.1.0':70C '8.3.1.0':82C '8.3.1.40':84C '8.6.1.0':88C '8.6.1.20':90C '8.8':72C 'access':101C 'account':10A,55B,110C 'allow':120C 'applianc':19B,33B 'attack':7A,49B,98C,122C 'authent':44B,94C 'backup':18B 'backup-appli':17B 'complet':125C 'contain':41B,91C 'control':59B,126C 'could':102C 'creat':8A,52B 'creation':111C 'critic':115C 'custom':132C 'cve':11A,14A 'data':3A,21B,31B,65C 'data-domain':20B 'dell':1A,23B,29B,63C,130C 'domain':4A,22B,32B,66C 'earliest':137C 'exploit':104C 'featur':36B,67C 'flaw':45B 'full':58B 'host':28B 'improp':43B,93C 'infrastructur':24B 'lead':107C 'line':40B 'lts':38B 'lts2024':73C 'lts2025':79C 'lts2026':85C 'opportun':138C 'potenti':51B,103C 'powerprotect':2A,25B,30B,64C 'privileg':9A,54B,109C 'recommend':131C 'releas':39B,68C,74C,80C,86C 'remot':6A,48B,100C 'self':27B 'self-host':26B 'sever':35B,116C 'system':62B,129C 'take':57B,124C 'unauthent':5A,47B,97C 'upgrad':134C 'version':69C,75C,81C,87C 'vulner':95C,106C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerProtect Data Domain appliances on the listed affected release lines that accept remote access from the network. The sources do not describe a non-default configuration that is required for exposure. Systems on versions outside the listed ranges are not affected per the description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86397","severity":null,"published_at":"2026-10-28T09:17:07+00:00","modified_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}