CVE-2026-86384

Summary

Dell PowerProtect Data Domain appliances contain a hard-coded cryptographic key used for encryption, allowing unauthenticated attackers to decrypt sensitive credentials and gain unauthorized access with compromised user privileges.

Exploitability

Exploitation is straightforward for an unauthenticated remote attacker due to the lack of authentication requirements and the presence of a fixed cryptographic key.

Blast radius

Successful exploitation could lead to full system compromise, including unauthorized data access, modification, and potential lateral movement within the environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Dell PowerProtect Data Domain LTS2026 release version 8.6.1.21 or later, as this version resolves the hard-coded key vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.