---
id: "CVE-2026-86397"
kind: "vulnerability"
aliases: ["CVE-2026-86397"]
title: "Dell PowerProtect Data Domain: unauthenticated remote attacker creates privileged accounts"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect", "self-hosted"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-28T09:17:07+00:00"
first_seen_at: "2026-10-28T09:32:03+00:00"
updated_at: "2026-10-28T09:33:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86397", "first_seen_at": "2026-10-28T09:32:03+00:00"}]
---

# Dell PowerProtect Data Domain: unauthenticated remote attacker creates privileged accounts

Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. An unauthenticated remote attacker can potentially create a privileged account and take full control of the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges in the Dell advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)
- Review the user account list for unexpected privileged accounts

## Fix

- Upgrade Data Domain OS to the fixed release recommended by Dell (fixed version numbers: unknown)

## Timeline

- 2026-10-28T09:32:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86397

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_