SECURITYCRITICALCVE-2026-86397

CVE-2026-86397: Dell PowerProtect Data Domain Improper Authentication Flaw (CVSS 9.8)

An unauthenticated network attacker can abuse an authentication flaw in Dell PowerProtect Data Domain. Fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30.

Dylan H.

Security Team

October 29, 2026
3 min read
CVE-2026-86397: Dell PowerProtect Data Domain Improper Authentication Flaw (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Dell PowerProtect Data Domain Feature Release 7.7.1.0 through 8.8
  • Dell PowerProtect Data Domain LTS2024 7.13.1.0 through 7.13.1.80
  • Dell PowerProtect Data Domain LTS2025 8.3.1.0 through 8.3.1.40
  • Dell PowerProtect Data Domain LTS2026 8.6.1.0 through 8.6.1.20

CVE-2026-86397: Critical Authentication Flaw in Dell Data Domain

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability, tracked as CVE-2026-86397 with a CVSS score of 9.8. An unauthenticated attacker with network access can exploit it. Third-party analysis describes the impact as creation of privileged accounts without credentials, and the record is also tagged CWE-862 (Missing Authorization).

The flaw is one of several critical issues fixed in Dell advisory DSA-2026-416. The CVE records were published on October 28, 2026.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-86397
CVSS Score9.8 (Critical)
WeaknessImproper Authentication / Missing Authorization (CWE-862)
Attack VectorNetwork, low complexity, no privileges required
Affected ProductDell PowerProtect Data Domain (DD OS)
Dell AdvisoryDSA-2026-416
Known ExploitationNone reported at time of writing
WorkaroundNone published; upgrade required

Affected and Fixed Versions

Release TrainAffectedFixed
Feature Release7.7.1.0 through 8.88.9.0.0
LTS20247.13.1.0 through 7.13.1.807.13.1.90
LTS20258.3.1.0 through 8.3.1.408.3.1.50
LTS20268.6.1.0 through 8.6.1.208.6.1.30

Why This Matters

Data Domain appliances are backup and deduplication targets. Backup infrastructure is a prime ransomware objective because attackers who control it can destroy recovery points before encrypting production systems. An unauthenticated flaw on a management interface turns any network foothold into a path toward backup tampering.

Three sibling CVEs were disclosed alongside this one: CVE-2026-86400, CVE-2026-86384, and CVE-2026-90717. Treat them as a single patching event.

Remediation

  1. Upgrade to the fixed build for your release train (table above).
  2. Restrict management access — Data Domain administrative interfaces should only be reachable from a dedicated management network or jump host.
  3. Audit local accounts on each appliance and investigate any unrecognized privileged users.
  4. Review authentication and audit logs for unexpected account creation or logins from unusual sources.
  5. Verify backup integrity and keep an immutable or offline copy of critical backups.
# On the Data Domain CLI, confirm the running version and list local users
system show version
user show list

Key Takeaways

  1. CVE-2026-86397 is a CVSS 9.8 unauthenticated flaw in Dell PowerProtect Data Domain.
  2. Dell published no workaround; the fix is upgrading to 8.9.0.0, 7.13.1.90, 8.3.1.50, or 8.6.1.30.
  3. No exploitation has been reported, but backup appliances are high-value targets, so patch quickly.
  4. Isolate management interfaces regardless of patch status.

Sources