---
id: "CVE-2026-86400"
kind: "vulnerability"
aliases: ["CVE-2026-86400"]
title: "Dell PowerProtect Data Domain: unauthenticated remote root command execution via authentication flaw"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect", "self-hosted"]
not_affected_if: ["not-remotely-reachable", "version-outside-listed-ranges"]
published_at: "2026-10-28T09:17:08+00:00"
first_seen_at: "2026-10-28T09:32:03+00:00"
updated_at: "2026-10-28T09:33:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86400", "first_seen_at": "2026-10-28T09:32:03+00:00"}]
---

# Dell PowerProtect Data Domain: unauthenticated remote root command execution via authentication flaw

Dell PowerProtect Data Domain appliances in several feature and LTS release lines contain an improper authentication flaw. A remote attacker without credentials could run arbitrary commands as root and take full control of the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges: 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, 8.6.1.0 through 8.6.1.20.
- Confirm whether the appliance is reachable from untrusted networks; the sources do not name the exact service or port involved.

## Fix

- Upgrade PowerProtect Data Domain to a fixed release as recommended by Dell; the sources do not name the exact fixed version numbers.
- Restrict management and remote access to the appliance to trusted networks until the upgrade is applied.

## Timeline

- 2026-10-28T09:32:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86400

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_