CVE-2026-86384: Hard-Coded Cryptographic Key in Data Domain
CVE-2026-86384 is a Use of Hard-coded Cryptographic Key vulnerability (CWE-321) in Dell PowerProtect Data Domain, scored CVSS 9.8. An unauthenticated remote attacker can exploit it. Because the key is identical across installations, anyone who recovers it from one copy of the software can use it against every unpatched appliance.
It was published October 28, 2026 under Dell advisory DSA-2026-416.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86384 |
| CVSS Score | 9.8 (Critical) |
| Weakness | Use of Hard-coded Cryptographic Key (CWE-321) |
| Authentication | None required |
| Dell Advisory | DSA-2026-416 |
| Known Exploitation | None reported at time of writing |
| Workaround | None published; upgrade required |
Affected and Fixed Versions
| Release Train | Affected | Fixed |
|---|---|---|
| Feature Release | 7.7.1.0 through 8.8 | 8.9.0.0 |
| LTS2024 | 7.13.1.0 through 7.13.1.80 | 7.13.1.90 |
| LTS2025 | 8.3.1.0 through 8.3.1.40 | 8.3.1.50 |
| LTS2026 | 8.6.1.0 through 8.6.1.20 | 8.6.1.30 |
Why Hard-Coded Keys Are Dangerous
A hard-coded key cannot be rotated by the customer. Once extracted through reverse engineering of the firmware or software image, it enables forging of trusted tokens or decrypting protected material on any affected system. Patch diffing of the fixed release is a common route to rediscovering such keys, which raises the odds of exploit development now that fixes are public.
Related CVEs in the same advisory: CVE-2026-86397, CVE-2026-86400, and CVE-2026-90717.
Remediation
- Upgrade to 8.9.0.0, 7.13.1.90, 8.3.1.50, or 8.6.1.30 depending on release train.
- Restrict network access to Data Domain interfaces to a dedicated management segment.
- Review logs for authentication or session activity from unexpected hosts.
- Rotate secrets (admin passwords, replication and integration credentials) after upgrading if compromise is suspected.
Key Takeaways
- CVSS 9.8, unauthenticated, caused by a shared hard-coded cryptographic key.
- No customer-side mitigation exists; only the fixed builds remove the issue.
- Treat all four DSA-2026-416 CVEs as one urgent patch cycle for backup infrastructure.