{"id":"CVE-2026-86400","kind":"vulnerability","aliases":["CVE-2026-86400"],"related":[],"title":"Dell PowerProtect Data Domain: unauthenticated remote root command execution via authentication flaw","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.","summary":"Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. A remote attacker without credentials could run arbitrary commands as root and take full control of the appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["not-remotely-reachable","version-outside-listed-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, 8.6.1.0 through 8.6.1.20.\n- Confirm whether the appliance is reachable from untrusted networks; the sources do not name the exact service or port involved.","fix":"- Upgrade PowerProtect Data Domain to a fixed release as recommended by Dell; the sources do not name the exact fixed version numbers.\n- Restrict management and remote access to the appliance to trusted networks until the upgrade is applied.","status":"open","published_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:33:59+00:00","updated_at":"2026-10-28T09:33:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PowerProtect Data Domain to a fixed release as recommended by Dell; the sources do not name the exact fixed version numbers.\n- Restrict management and remote access to the appliance to trusted networks until the upgrade is applied.","reach":"internet","title":"Dell PowerProtect Data Domain: unauthenticated remote root command execution via authentication flaw","impact":"high","summary":"Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. A remote attacker without credentials could run arbitrary commands as root and take full control of the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary commands as root on the appliance.","analyst_note":"Find Dell's security advisory for the fixed versions per release line and confirm which service is exposed and whether it is on by default.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, 8.6.1.0 through 8.6.1.20.\n- Confirm whether the appliance is reachable from untrusted networks; the sources do not name the exact service or port involved.","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges","not-remotely-reachable"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed feature release or LTS2024, LTS2025 and LTS2026 versions that are reachable remotely. Appliances on other versions, or those not exposed to remote access, are less exposed; the sources do not state further conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":3469,"output_tokens":694,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86400':15A,18A '7.13.1.0':79C '7.13.1.80':81C '7.7.1.0':73C '8.3.1.0':85C '8.3.1.40':87C '8.6.1.0':91C '8.6.1.20':93C '8.8':75C 'access':104C 'allow':126C 'applianc':21B,35B,65B 'arbitrari':55B,112C 'attack':50B,101C,128C 'authent':11A,46B,97C 'backup':20B 'backup-appli':19B 'command':8A,56B,113C 'complet':131C 'contain':43B,94C 'control':62B,132C 'could':53B,105C 'credenti':52B 'critic':121C 'custom':138C 'cve':13A,16A 'data':3A,23B,33B,68C 'data-domain':22B 'dell':1A,25B,31B,66C,136C 'domain':4A,24B,34B,69C 'earliest':143C 'execut':9A,114C 'exploit':107C 'featur':38B,70C 'flaw':12A,47B 'full':61B 'host':30B 'improp':45B,96C 'infrastructur':26B 'lead':110C 'line':42B 'lts':40B 'lts2024':76C 'lts2025':82C 'lts2026':88C 'opportun':144C 'potenti':106C 'powerprotect':2A,27B,32B,67C 'privileg':117C 'recommend':137C 'releas':41B,71C,77C,83C,89C 'remot':6A,49B,103C 'root':7A,58B,116C 'run':54B 'self':29B 'self-host':28B 'sever':37B,122C 'system':135C 'take':60B,130C 'unauthent':5A,100C 'upgrad':140C 'version':72C,78C,84C,90C 'via':10A 'vulner':98C,109C,123C 'without':51B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed feature release or LTS2024, LTS2025 and LTS2026 versions that are reachable remotely. Appliances on other versions, or those not exposed to remote access, are less exposed; the sources do not state further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86400","severity":null,"published_at":"2026-10-28T09:17:08+00:00","modified_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}