Article
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs
Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
Read more
Vulnerability
Dell PowerProtect Data Domain unauthenticated privileged account creation (CVE-2026-86397)
An improper authentication flaw in Dell PowerProtect Data Domain.
- CVE ID
- CVE-2026-86397
- CVSS
- 9.8 Critical (CVSS 3.1, Dell as CNA)
- Affected product
- PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Exploited
- Unknown
- Published
- 28 October 2026 (CVE record); Dell advisory DSA-2026-416 dated 1 October 2026
In short
CVE-2026-86397 is an improper authentication flaw in Dell PowerProtect Data Domain. Dell says an unauthenticated attacker with remote access could create a privileged account and take complete control. It is rated 9.8 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
- CVECVE-2026-86397
- ProductDell PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Fix Steps5actions listedFind your builds · Upgrade
What it allows
Dell describes CVE-2026-86397 as an improper authentication flaw. An unauthenticated attacker with remote access could create a privileged account. Dell calls it critical because it allows an attacker to take complete control of the system, and recommends upgrading at the earliest opportunity.
Dell, as CNA, scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE record files it under CWE-862, Missing Authorization, although Dell's text says improper authentication.
Authentication or Authorization?
Dell and the CVE record use two names for the same flaw. This is our reading: the weakness class describes a missing check on who may create accounts, and Dell's text describes the result for the attacker. Either way, no login is needed.
What Dell Does Not Say
Dell does not say which interface or request creates the account, what privilege level the new account gets beyond "privileged", or whether the account shows in the normal user list. The advisory describes no exploitation and lists no workaround.
Why an Extra Account Is Hard to Notice
A new privileged account gives lasting access that survives the patch. That is our reasoning, not a Dell statement. After upgrading, check the user list for accounts nobody created.
Who is affected
Dell's remediation table lists Data Domain series appliances, Data Domain Virtual Edition and Dell APEX Protection Storage with DD OS, and Data Domain Management Center, as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.
Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Each fix applies from that build onward. Dell's table starts at 7.7.1.0 and does not say whether older DD OS releases are affected.
Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.
The same advisory has six more critical flaws with their own pages.
Timeline
- 1 Oct 2026
Dell publishes DSA-2026-416; its revision history shows this date as the initial release. Revision 2.0 followed on 7 Oct 2026 as "Minor updates".
- 19 Oct 2026
Revision 3.0 of the advisory adds six other CVEs to it, not this one. Dell's page shows 19 Oct 2026 as its last modification.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 28 Oct 2026
Dell, as CNA, publishes the CVE record at 09:02 UTC. It carries Dell's score and the fixed builds.
What to do
-
Find your builds
List every Data Domain system with its DD OS build, including virtual editions and APEX Protection Storage.
-
Upgrade
Move to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later. Dell asks for the upgrade at the earliest opportunity.
-
Audit accounts
List all local users and their roles. Look for accounts that nobody created, especially privileged ones, and compare with your change records.
-
Check recent logins
Review who logged in to the appliance since the advisory of 1 October 2026 and from where.
-
Limit who can reach it
Open management access only to an admin network. This is hardening, not a Dell workaround.
Questions
Which DD OS builds fix CVE-2026-86397?
DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.
Is CVE-2026-86397 exploited?
Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.
Does CVE-2026-86397 need a login?
No. Dell describes an unauthenticated attacker with remote access.
Is it authentication or authorization?
Dell's text says improper authentication, while the CVE record lists CWE-862, Missing Authorization. Neither needs a login from the attacker.
What should I check after upgrading?
Review the local user list for privileged accounts that nobody created, because the flaw lets an attacker create one.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.