{"id":"CVE-2026-86399","kind":"vulnerability","aliases":["CVE-2026-86399"],"related":[],"title":"Dell PowerProtect Data Domain: OS command injection lets a privileged user run commands","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","summary":"Several Dell PowerProtect Data Domain releases contain an OS command injection flaw in which special characters are not neutralized before being passed to the operating system. A high-privileged attacker with remote access could run commands on the appliance.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","on-prem","powerprotect"],"not_affected_if":["no-remote-admin-access","unaffected-release"],"how_to_check":"- Check the installed release version on the Data Domain system against the affected ranges in the description: `7.7.1.0` through `8.8`, `7.13.1.0` through `7.13.1.80`, `8.3.1.0` through `8.3.1.40`, `8.6.1.0` through `8.6.1.20`\n- Confirm which accounts hold high-privilege roles on the appliance; the sources do not name a specific setting or command to inspect","fix":"- Move Data Domain systems to a fixed release from Dell's advisory; the sources do not list the fixed version numbers\n- Until patched, restrict high-privilege and remote administrative access to trusted management networks","status":"open","published_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:04+00:00","updated_at":"2026-10-28T09:34:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain systems to a fixed release from Dell's advisory; the sources do not list the fixed version numbers\n- Until patched, restrict high-privilege and remote administrative access to trusted management networks","reach":"network","title":"Dell PowerProtect Data Domain: OS command injection lets a privileged user run commands","impact":"high","summary":"Several Dell PowerProtect Data Domain releases contain an OS command injection flaw in which special characters are not neutralized before being passed to the operating system. A high-privileged attacker with remote access could run commands on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges runs arbitrary OS commands on the appliance.","analyst_note":"Find Dell's advisory for the fixed release numbers and the exact privilege level required; check https://nvd.nist.gov/vuln/detail/CVE-2026-86399 for the full CVSS vector.","how_to_check":"- Check the installed release version on the Data Domain system against the affected ranges in the description: `7.7.1.0` through `8.8`, `7.13.1.0` through `7.13.1.80`, `8.3.1.0` through `8.3.1.40`, `8.6.1.0` through `8.6.1.20`\n- Confirm which accounts hold high-privilege roles on the appliance; the sources do not name a specific setting or command to inspect","needs_analyst":true,"not_affected_if":["unaffected-release","no-remote-admin-access"],"who_is_affected":"Owners of Dell PowerProtect Data Domain appliances running the affected feature or LTS release ranges listed in the description. The attacker needs high privileges and remote access, so exposure depends on who holds admin accounts and whether the management interface is reachable from untrusted networks. Systems on unaffected releases can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":3429,"output_tokens":715,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86399':16A,19A '7.13.1.0':83C '7.13.1.80':85C '7.7.1.0':77C '8.3.1.0':89C '8.3.1.40':91C '8.6.1.0':95C '8.6.1.20':97C '8.8':79C 'access':63B,120C 'applianc':69B 'attack':60B,117C 'backup':20B 'charact':45B 'command':6A,13A,39B,66B,109C,111C,128C 'contain':36B,98C 'could':64B,121C 'cve':14A,17A 'data':3A,22B,33B,72C 'data-domain':21B 'dell':1A,24B,31B,70C 'domain':4A,23B,34B,73C 'element':104C 'execut':129C 'exploit':123C 'featur':74C 'flaw':41B 'high':58B,115C 'high-privileg':57B 'improp':100C 'infrastructur':25B 'inject':7A,40B,112C 'lead':126C 'let':8A 'lts2024':80C 'lts2025':86C 'lts2026':92C 'neutral':48B,101C 'on-prem':26B 'oper':54B 'os':5A,38B,108C,110C 'pass':51B 'potenti':122C 'powerprotect':2A,29B,32B,71C 'prem':28B 'privileg':10A,59B,116C 'releas':35B,75C,81C,87C,93C 'remot':62B,119C 'run':12A,65B 'sever':30B 'special':44B,103C 'system':55B 'use':105C 'user':11A 'version':76C,82C,88C,94C 'vulner':113C,125C","nicknames":[],"mitigations":[],"who_affected":"Owners of Dell PowerProtect Data Domain appliances running the affected feature or LTS release ranges listed in the description. The attacker needs high privileges and remote access, so exposure depends on who holds admin accounts and whether the management interface is reachable from untrusted networks. Systems on unaffected releases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86399","severity":null,"published_at":"2026-10-28T09:17:07+00:00","modified_at":"2026-10-28T09:17:07+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}