Dell PowerProtect Data Domain Improper Auth (Unauth Remote) 7.7.1.0-8.8, LTS24-26
CVE-2026-86397 Published on October 28, 2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to privileged account creation. This is a critical severity vulnerability as it allows an attacker to take complete control of the system. Dell recommends customers to upgrade at the earliest opportunity.
Vulnerability Analysis
CVE-2026-86397 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-86397 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
Dell PowerProtect Data Domain:- Before 8.9.0.0 or later is affected.
- Before 7.13.1.90 or later is affected.
- Before 8.3.1.50 or later is affected.
- Before 8.6.1.30 or later is affected.