Dell Fixes Critical PowerProtect Data Domain Vulnerabilities, Four Rated CVSS 9.8
Do Son 
TL;DR
Dell’s security advisory DSA-2026-416 lists more than 180 CVEs affecting its backup appliances. Among them are 48 Dell-specific PowerProtect Data Domain vulnerabilities. Four of these score 9.8 on CVSS v3.1 and need no login to exploit.
Unauthenticated attackers could gain root command execution or create privileged accounts on Data Domain systems. The advisory also patches dozens of third-party components inside DD OS. Upgrade to the fixed DD OS release for your branch now.
- Total: 9 CVEs
- Severity: 7 Critical · 2 High
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-86400
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-86400 | 9.8 | CWE-287 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-86397 | 9.8 | CWE-862 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-86384 | 9.8 | CWE-321 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-103780 | 9.8 | CWE-121 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-103799 | 9.6 | CWE-862 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-103792 | 9.6 | CWE-89 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-90717 | 9.1 | CWE-290 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
| CVE-2026-86396 | 8.8 | CWE-78 | 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later (+1) | Not exploited |
Why It Matters
Data Domain appliances store an organization’s backups. An attacker who controls the backup system can delete or corrupt those copies. As a result, a full takeover could block recovery after a ransomware attack or outage.
Dell rates the overall impact as “Critical.” In total, seven Dell-specific flaws score 9.0 or higher. For two of them, the advisory warns that “this is a critical severity vulnerability as it allows an attacker to take complete control of the system.” Consequently, Dell “recommends customers to upgrade at the earliest opportunity.”
How the Attack Works
Unauthenticated critical flaws
Four Dell-specific bugs need only network access:
- CVE-2026-86400: an improper authentication flaw “leading to arbitrary command execution with root privileges.”
- CVE-2026-86397: another authentication flaw “leading to privileged account creation.”
- CVE-2026-86384: a hard-coded cryptographic key that leads to “credential exposure.”
- CVE-2026-103780: a stack-based buffer overflow “leading to command execution.”
Management Center flaws
The advisory also covers Data Domain Management Center, which controls other appliances. CVE-2026-103799 and CVE-2026-103792 both score 9.6. They let a low-privileged user reach “managed systems” through missing authorization and SQL injection. Similarly, CVE-2026-90717 (CVSS 9.1) is an authentication bypass that “could impact other managed Data Domain systems.”
Authenticated flaws
Several high-severity bugs need a low-privileged account. These include OS command injection (CVE-2026-86396) and path traversal (CVE-2026-86398), both rated 8.8. Many more require admin rights.
Medium and low severity flaws
A few lower-rated bugs also need no login. For instance, CVE-2026-56084 is a server-side request forgery rated 5.8. Likewise, CVE-2026-86388 is a path traversal rated 5.3, and CVE-2026-92665 allows resource exhaustion. Meanwhile, the Management Center carries several SQL injection flaws with low scores, since they require admin access.
Third-party components
The rest of the CVEs come from bundled software. The list includes Apache HTTP Server, Tomcat, nginx, OpenSSL, curl, BIND, rsync, Helm and Python packages. It also includes iDRAC9 flaws covered in Dell’s DSA-2026-312. In total, Dell lists 29 third-party component entries. Some of these bugs date back to 2021, such as CVE-2021-23337 in Lodash.
Affected Versions
The PowerProtect Data Domain vulnerabilities affect appliances, Virtual Edition and Management Center on these DD OS branches:
- Feature Release 7.7.1.0 through 8.8
- LTS2024 7.13.1.0 through 7.13.1.80
- LTS2025 8.3.1.0 through 8.3.1.40
- LTS2026 8.6.1.0 through 8.6.1.20
Patch and Mitigation
Upgrade to DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, depending on your branch. Virtual Edition users should check the advisory’s separate table, since two flaws (CVE-2026-86395 and CVE-2026-94347) list slightly different fixed builds. Dell links its DD OS upgrade guide from the same page. In addition, keep Data Domain management interfaces on an isolated admin network.
Dell first published the advisory on October 1. It then added six new proprietary CVEs, including the critical CVE-2026-103780, on October 19. So far, Dell has not reported any exploitation, and none of the flaws appear in CISA’s KEV catalog.
Dell credits Ahmed Y. Elmogy for CVE-2026-56084 and songxiaoyue for three buffer overflow bugs.
Dell also notes that some scanners “may still report False Positive findings after upgrading.” Full details on the PowerProtect Data Domain vulnerabilities are in Dell security advisory DSA-2026-416.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
