CVE-2026-86400

Summary

An improper authentication flaw (CWE-287) in Dell PowerProtect Data Domain allows unauthenticated remote attackers to execute arbitrary commands as root across multiple affected versions (7.7.1.0–8.8, 7.13.1.0–7.13.1.80, 8.3.1.0–8.3.1.40, 8.6.1.0–8.6.1.20), enabling full system compromise.

Exploitability

Highly exploitable: no authentication or user interaction is required, and the vulnerability permits remote code execution with root privileges.

Blast radius

Successful exploitation grants attackers complete control of the affected Data Domain system, risking data exfiltration, ransomware deployment, or lateral movement within backup infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Dell PowerProtect Data Domain LTS2026 release version 8.6.1.21 or later, LTS2025 release version 8.3.1.41 or later, LTS2024 release version 7.13.1.81 or later, or Feature Release version 8.9 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.