Dell PowerProtect Data Domain: Hard-coded cryptographic key exposes credentials

Summary

Dell PowerProtect Data Domain contains a hard-coded cryptographic key (CWE-321). An unauthenticated remote attacker can potentially obtain credentials, which may then be used with the privileges of the compromised user. The CVSS base score is 9.8 (CRITICAL), and the flaw is in the same advisory as several other critical vulnerabilities.

Affected

• Feature Release 7.7.1.0 through 8.8
• LTS2024 release 7.13.1.0 through 7.13.1.80
• LTS2025 release 8.3.1.0 through 8.3.1.40
• LTS2026 release 8.6.1.0 through 8.6.1.20

Fixed in

• LTS2025: 8.3.1.50 (per research notes of the Dell advisory)
• LTS2026: 8.6.1.30 (per research notes of the Dell advisory)
• LTS2024: 7.13.1.90 and Feature Release line: 8.9.0.0 (reported by third parties, not confirmed in the Dell text reviewed)
• Check the full Dell advisory DSA-2026-416 for the exact fixed build of each line before upgrading.

Workaround

Unknown. No vendor workaround was found for this CVE. Restricting management access to an isolated admin network is general hardening, not a fix.

Exploitation

• No known exploitation reported by Dell.
• Not listed in the CISA KEV catalog as of the sources reviewed.
• No public proof of concept known (VulDB: exploit not publicly available).
• EPSS: 0.47 % (percentile 41).

Our recommendation

• Identify all Data Domain systems and confirm whether their management interface or appliance is reachable from the internet or untrusted networks; restrict access if so.
• Upgrade to the fixed build for your release line as listed in the Dell advisory, not only for this CVE, because the advisory bundles several other critical flaws.
• After patching, rotate appliance and integration credentials that may have been protected by the hard-coded key.
• Monitor authentication logs for unusual logins; expect some scanners to report false positives after upgrading.
• Recheck the Dell advisory revisions, CISA KEV and NVD analysis, as the data may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Dell DSA-2026-416 Security Update www.dell.com
• Brandefense: Dell Data Domain critical vulnerabilities (DSA-2026-416) brandefense.io
• VulDB CVE-2026-86384 (427807) vuldb.com
• SecurityOnline: Dell PowerProtect Data Domain vulnerabilities securityonline.info
• CVE-2026-86384 at threatint cve.threatint.com
• Strix: CVE-2026-86384 www.strix.ai
• Canadian Centre for Cyber Security: Dell advisory AV26-366 www.cyber.gc.ca

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:15.