Log in Request a demo

Vulnerability

Dell PowerProtect Data Domain unauthenticated root command execution (CVE-2026-86400)

An improper authentication flaw in Dell PowerProtect Data Domain.

CVE ID
CVE-2026-86400
CVSS
9.8 Critical (CVSS 3.1, Dell as CNA)
Affected product
PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
Exploited
Unknown
Published
28 October 2026 (CVE record); Dell advisory DSA-2026-416 dated 1 October 2026

In short

CVE-2026-86400 is an improper authentication flaw in Dell PowerProtect Data Domain. Dell says an unauthenticated attacker with remote access could run arbitrary commands with root privileges. It is rated 9.8 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.

Profile MapVulnerability
  1. CVECVE-2026-86400
  2. ProductDell PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
  3. Fix Steps5actions listedFind your builds · Upgrade

What it allows

Dell describes CVE-2026-86400 as an improper authentication flaw. An unauthenticated attacker with remote access could run arbitrary commands with root privileges. Dell calls it critical because it lets an attacker take complete control of the system, and recommends upgrading at the earliest opportunity.

Dell, as CNA, scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVE record lists CWE-287, Improper Authentication.

What the Vector Implies

This is our reading of the vector, not a statement from Dell. The attack runs over the network with low complexity. It needs no privileges and no user action, and the impact on confidentiality, integrity and availability is high.

What Dell Does Not Say

Dell does not name the service, port or interface where the authentication check fails. It does not say whether the flaw can be reached from the internet by default, and its advisory describes no exploitation. The advisory lists no workaround.

Why Root Matters on a Backup Appliance

Root is the highest local privilege. Whoever has it controls the system and everything it stores. That is why Dell asks customers to upgrade at the earliest opportunity.

Who is affected

Dell's remediation table lists Data Domain series appliances, Data Domain Virtual Edition and Dell APEX Protection Storage with DD OS, and Data Domain Management Center, as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.

Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Each fix applies from that build onward. Dell's table starts at 7.7.1.0 and does not say whether older DD OS releases are affected.

Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.

The same advisory has six more critical flaws with their own pages.

Timeline

  1. 1 Oct 2026

    Dell publishes DSA-2026-416; its revision history shows this date as the initial release. Revision 2.0 followed on 7 Oct 2026 as "Minor updates".

  2. 19 Oct 2026

    Revision 3.0 of the advisory adds six other CVEs to it, not this one. Dell's page shows 19 Oct 2026 as its last modification.

  3. 27 Oct 2026

    The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.

  4. 28 Oct 2026

    Dell, as CNA, publishes the CVE record at 08:50 UTC. It carries Dell's score and the fixed builds.

What to do

  1. Find your builds

    List every Data Domain appliance, virtual edition and APEX Protection Storage system with its DD OS build. Dell's table covers 7.7.1.0 through 8.8.0.0 on the Feature Release line and the LTS ranges above.

  2. Upgrade

    Move to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later, for your release line. The advisory lists no workaround.

  3. Restrict management access

    Keep every management interface off the internet and open it only to an admin network. Dell does not say where the flaw sits, so limit all of them. This is hardening, not a Dell workaround.

  4. Review accounts and logins

    After patching, review local accounts and recent administrator logins for anything nobody can explain.

  5. Keep a separate copy

    Keep critical backups in a copy that Data Domain administrators cannot change, as on our immutable backup page. Root on one system should not reach every copy.

Questions

Which DD OS builds fix CVE-2026-86400?

DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.

Is CVE-2026-86400 exploited?

Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.

Does CVE-2026-86400 need a login?

No. Dell describes an unauthenticated attacker with remote access, and the vector sets privileges required to none.

What can an attacker do with it?

Dell says arbitrary command execution with root privileges, which it describes as complete control of the system.

Is there a workaround?

Dell's advisory lists none. Upgrade to a remediated DD OS build.

In our research

  1. Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs October 2026

Sources

  1. DSA-2026-416: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities Dell
  2. CVE-2026-86400 NVD
  3. Known Exploited Vulnerabilities catalog CISA
  4. CWE-287: Improper Authentication MITRE

Last updated 28 October 2026

Browse the threat library

Keep exploring

Knowledge Hub