CVE-2026-86400: Unauthenticated Root Command Execution on Data Domain
CVE-2026-86400 is an Improper Authentication vulnerability in Dell PowerProtect Data Domain, rated CVSS 9.8. An unauthenticated remote attacker can bypass security controls and execute arbitrary commands with root privileges on the appliance.
It is part of Dell advisory DSA-2026-416, published to NVD on October 28, 2026 together with CVE-2026-86397, CVE-2026-86384, and CVE-2026-90717.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-86400 |
| CVSS Score | 9.8 (Critical) |
| Weakness | Improper Authentication |
| Impact | Arbitrary command execution as root |
| Authentication | None required |
| Dell Advisory | DSA-2026-416 |
| Known Exploitation | None reported; no public proof-of-concept indexed at time of writing |
| Workaround | None published; upgrade required |
Affected and Fixed Versions
| Release Train | Affected | Fixed |
|---|---|---|
| Feature Release | 7.7.1.0 through 8.8 | 8.9.0.0 |
| LTS2024 | 7.13.1.0 through 7.13.1.80 | 7.13.1.90 |
| LTS2025 | 8.3.1.0 through 8.3.1.40 | 8.3.1.50 |
| LTS2026 | 8.6.1.0 through 8.6.1.20 | 8.6.1.30 |
Risk Assessment
Root-level execution on a backup appliance gives an attacker control over the data that organizations rely on for recovery. Possible outcomes include deletion or corruption of backup sets, theft of backup contents, and use of the appliance as a pivot point into the management network.
Related disclosures in the same advisory: CVE-2026-86397, CVE-2026-86384, and CVE-2026-90717.
Remediation
- Upgrade every Data Domain system to the fixed build for its release train.
- Limit network reach of the appliance's management and API interfaces to administrative hosts only.
- Monitor for unexpected processes, new accounts, configuration changes, or unusual outbound connections from the appliance.
- Confirm backup health — verify recent restore points are intact and retain an immutable copy.
Key Takeaways
- CVSS 9.8 unauthenticated root command execution on Dell PowerProtect Data Domain.
- Fixed in 8.9.0.0, 7.13.1.90, 8.3.1.50, and 8.6.1.30; no workaround is available.
- No in-the-wild exploitation has been reported yet — the window to patch before exploit development is short.