Dell published CVE records on 28 October 2026 for critical flaws in PowerProtect Data Domain, its backup appliance line. Four of them need no login and score 9.8 on the CVSS 3.1 scale. Dell’s advisory DSA-2026-416 is rated Critical and names the fixed DD OS builds: 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
The advisory is older than the CVE records. Its revision history shows an initial release on 1 October 2026 and a third revision on 19 October. Dell’s advisory describes no exploitation, and none of the CVEs it names is in the CISA Known Exploited Vulnerabilities catalog.
Each of the seven critical flaws has its own page: CVE-2026-86400, CVE-2026-86397, CVE-2026-86384, CVE-2026-103780, CVE-2026-103799, CVE-2026-103792 and CVE-2026-90717.
Last updated: 28 October 2026. We update this page if Dell revises its advisory.
Which Seven Flaws in Dell’s Own Code Score 9.0 or Higher?
The table ranks the seven by Dell’s CVSS 3.1 score, highest first, and the CVE pages hold the detail.
| CVE | Product | Dell’s description, shortened | Attacker needs | CVSS 3.1 |
|---|---|---|---|---|
| CVE-2026-86400 | Data Domain | Improper authentication; arbitrary command execution with root privileges | No login | 9.8 |
| CVE-2026-86397 | Data Domain | Improper authentication; privileged account creation | No login | 9.8 |
| CVE-2026-86384 | Data Domain | Hard-coded cryptographic key; credential exposure | No login | 9.8 |
| CVE-2026-103780 | Data Domain | Stack-based buffer overflow; command execution | No login | 9.8 |
| CVE-2026-103799 | Management Center | Missing authorization; unauthorized operation on managed systems | Low-privileged account | 9.6 |
| CVE-2026-103792 | Management Center | SQL injection; unauthorized access to managed systems | Low-privileged account | 9.6 |
| CVE-2026-90717 | Management Center | Authentication bypass by spoofing; privilege elevation that could impact other managed systems | Low-privileged account | 9.1 |
The advisory scores 48 flaws in Dell’s own code: 7 critical, 18 high, 17 medium and 6 low. Two of the high ones are CVE-2026-86396, an OS command injection, and CVE-2026-86398, a path traversal, both rated 8.8 and both open to a low-privileged attacker with remote access. It also lists many third-party components, among them Apache HTTP Server, nginx, curl and Apache Tomcat.
Which Other Flaws in Dell’s Own Code Does the Advisory List?
The 41 flaws below the critical line are listed here so none is missing: 18 high, 17 medium and 6 low. All sit in Dell’s own code, and the fixed builds above cover every one of them.
Dell lists some only for certain products or release lines. It fixed three of them, CVE-2026-68866, CVE-2026-94346 and CVE-2026-94347, in earlier LTS builds: 7.13.1.80, 8.3.1.40 and 8.6.1.20.
| Rating | CVE | Flaw type in Dell’s table | CVSS 3.1 |
|---|---|---|---|
| High | CVE-2026-86378 | Stack-based Buffer Overflow | 8.8. |
| High | CVE-2026-86385 | Improper Check for Dropped Privileges | 8.8. |
| High | CVE-2026-86396 | OS command injection | 8.8. |
| High | CVE-2026-86398 | Path traversal | 8.8. |
| High | CVE-2026-103779 | Improper Authentication | 8.3. |
| High | CVE-2026-86377 | Out-of-bounds Write | 7.6. |
| High | CVE-2026-110541 | OS command injection | 7.2. |
| High | CVE-2026-86379 | OS command injection | 7.2. |
| High | CVE-2026-86380 | Integer Overflow or Wraparound | 7.2. |
| High | CVE-2026-86389 | Integer Overflow or Wraparound | 7.2. |
| High | CVE-2026-86393 | Improper Privilege Management | 7.2. |
| High | CVE-2026-86394 | OS command injection | 7.2. |
| High | CVE-2026-86395 | OS command injection | 7.2. |
| High | CVE-2026-86399 | OS command injection | 7.2. |
| High | CVE-2026-90718 | OS command injection | 7.2. |
| High | CVE-2026-94346 | Path Traversal | 7.2. |
| High | CVE-2026-94347 | Process Control | 7.2. |
| High | CVE-2026-110540 | Missing Authorization | 7.1. |
| Medium | CVE-2026-86383 | Path traversal | 6.8. |
| Medium | CVE-2026-90720 | Improper Validation of Integrity Check Value | 6.7. |
| Medium | CVE-2026-90729 | Improper Privilege Management | 6.7. |
| Medium | CVE-2026-68866 | Relative Path Traversal | 6.5. |
| Medium | CVE-2026-86390 | Missing Authorization | 6.5. |
| Medium | CVE-2026-90730 | Improper Access Control | 6.5. |
| Medium | CVE-2026-86391 | Authentication Bypass by Spoofing | 6.4. |
| Medium | CVE-2026-90728 | Improper Privilege Management | 6.3. |
| Medium | CVE-2026-90726 | Path Traversal | 6.0. |
| Medium | CVE-2026-56084 | Server-Side Request Forgery (SSRF) | 5.8. |
| Medium | CVE-2026-86388 | Path traversal | 5.3. |
| Medium | CVE-2026-92665 | Allocation of Resources Without Limits or Throttling | 5.3. |
| Medium | CVE-2026-86392 | Heap-based Buffer Overflow | 4.9. |
| Medium | CVE-2026-90725 | Stack-based Buffer Overflow | 4.9. |
| Medium | CVE-2026-90731 | Stack-based Buffer Overflow | 4.9. |
| Medium | CVE-2026-90732 | Stack-based Buffer Overflow | 4.9. |
| Medium | CVE-2026-86386 | SQL injection | 4.3. |
| Low | CVE-2026-90727 | Relative Path Traversal | 3.8. |
| Low | CVE-2026-90721 | Path Traversal | 3.4. |
| Low | CVE-2026-86401 | SQL injection | 2.7. |
| Low | CVE-2026-90719 | SQL injection | 2.7. |
| Low | CVE-2026-90723 | SQL injection | 2.7. |
| Low | CVE-2026-90724 | SQL injection | 2.7. |
Which DD OS Build Fixes Your System?
Dell’s remediation table covers Data Domain series appliances, Data Domain Virtual Edition, APEX Protection Storage and Data Domain Management Center. The critical flaws are fixed on all four release lines.
Dell’s table starts at 7.7.1.0. It does not say whether older DD OS releases are affected, so ask Dell support about anything below that.
What Does Dell Not Say?
The advisory does not name the service, port or interface behind any flaw. It says only that the attacker has remote access. It lists no workaround, and it does not say whether the flaws can be chained.
For CVE-2026-90717, Dell says the flaw could impact other managed Data Domain systems. Management Center manages those systems, so patch it together with the systems it manages.
Dell also warns that some security scanners may still report false positives after an upgrade. It publishes a false-positive article for each of DD OS 8.9, 8.6, 8.3 and 7.13.
Is Anyone Exploiting These Flaws?
- CISA KEVNot seenNone of the 179 CVEs in the advisory is in the catalog release of 27 October 202627 Oct
- Exploitation reported by DellUnknownThe advisory describes no exploitation28 Oct
- Another Dell recovery product in KEVYesRecoverPoint for Virtual Machines, CVE-2026-22769, a hard-coded credentials flaw18 Feb 2026
- XYesNine posts on 28 October from three small accounts, all repeating the advisory or the CVE records28 Oct
We are not saying these flaws are exploited. A backup system matters to ransomware crews because it holds the copies a victim would restore from. Our Akira ransomware profile records actors exploiting unpatched Veeam backup servers. Our post on the Veeam Backup & Replication fixes of 27 October covers four older Veeam flaws that CISA flags as used in ransomware.
What Should Backup Teams Do This Week?
- List every Data Domain system, including virtual editions, APEX Protection Storage and Management Center, with its DD OS build.
- Upgrade each one to the fixed build for its release line, and Management Center together with the systems it manages.
- Keep management interfaces off the internet and open them only to an admin network. This is network segmentation, not a Dell workaround, and Dell does not say which interface the flaws sit on.
- After the upgrade, review the local user list for accounts nobody created. CVE-2026-86397 allows privileged account creation.
- Change the passwords of accounts that administer the appliance. Dell does not require this, but CVE-2026-86384 is about credential exposure.
- Check that critical backups also exist in a copy that Data Domain administrators cannot change, as described on our immutable backup page.
For the wider routine, see our entries on patch management and the Known Exploited Vulnerabilities catalog.