Article
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs
Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
Read more
Vulnerability
Dell PowerProtect Data Domain hard-coded cryptographic key (CVE-2026-86384)
A hard-coded cryptographic key flaw in Dell PowerProtect Data Domain.
- CVE ID
- CVE-2026-86384
- CVSS
- 9.8 Critical (CVSS 3.1, Dell as CNA)
- Affected product
- PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Exploited
- Unknown
- Published
- 28 October 2026 (CVE record); Dell advisory DSA-2026-416 dated 1 October 2026
In short
CVE-2026-86384 is a hard-coded cryptographic key flaw in Dell PowerProtect Data Domain. Dell says an unauthenticated attacker with remote access could expose credentials and use them with the privileges of the compromised user. It is rated 9.8 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
- CVECVE-2026-86384
- ProductDell PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Fix Steps5actions listedFind your builds · Upgrade
What it allows
Dell describes CVE-2026-86384 as a use of a hard-coded cryptographic key. An unauthenticated attacker with remote access could expose credentials. Dell adds that the credentials may be used to access the system with the privileges of the compromised user.
Dell, as CNA, scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE record lists CWE-321, Use of Hard-coded Cryptographic Key.
What a Hard-coded Key Means
MITRE says that a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. In our reading, a key built into the product is not one an administrator can rotate. Dell does not say how the key is used here.
What Dell Does Not Say
Dell does not say whose credentials are exposed, which privilege level they carry, or what the key protects. It gives no workaround and describes no exploitation.
A Similar Class on Another Dell Product
CISA added a different Dell product, RecoverPoint for Virtual Machines, to its Known Exploited Vulnerabilities catalog on 18 February 2026. That flaw, CVE-2026-22769, is a hard-coded credentials flaw. It is a different product and a different weakness, and we mention it only because the class is related.
Who is affected
Dell's remediation table lists Data Domain series appliances, Data Domain Virtual Edition and Dell APEX Protection Storage with DD OS, and Data Domain Management Center, as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.
Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Each fix applies from that build onward. Dell's table starts at 7.7.1.0 and does not say whether older DD OS releases are affected.
Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.
The same advisory has six more critical flaws with their own pages.
Timeline
- 1 Oct 2026
Dell publishes DSA-2026-416; its revision history shows this date as the initial release. Revision 2.0 followed on 7 Oct 2026 as "Minor updates".
- 19 Oct 2026
Revision 3.0 of the advisory adds six other CVEs to it, not this one. Dell's page shows 19 Oct 2026 as its last modification.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 28 Oct 2026
Dell, as CNA, publishes the CVE record at 09:51 UTC. It carries Dell's score and the fixed builds.
What to do
-
Find your builds
List every Data Domain system with its DD OS build and check it against Dell's affected ranges.
-
Upgrade
Move to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later. A key built into the product is not one you can rotate, so the update is the fix (our reading).
-
Change administrator passwords
After the upgrade, change the passwords of accounts that administer the appliance. Dell does not require this; the flaw is about credential exposure.
-
Review logins
Check recent logins to the appliance for accounts or locations you do not expect.
-
Limit network reach
Open management access only to an admin network. This is hardening, not a Dell workaround.
Questions
Which DD OS builds fix CVE-2026-86384?
DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.
Is CVE-2026-86384 exploited?
Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.
Does CVE-2026-86384 need a login?
No. Dell describes an unauthenticated attacker with remote access.
What does the attacker get?
Credentials. Dell says they may be used to access the system with the privileges of the compromised user.
Is CVE-2026-86384 the same as the RecoverPoint flaw in KEV?
No. CVE-2026-22769 affects Dell RecoverPoint for Virtual Machines, a different product. Both are hard-coded credential or key flaws.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.