Dell PowerProtect Data Domain: OS command injection

Summary

Dell PowerProtect Data Domain backup appliances contain an OS command injection vulnerability (CWE-78) that is rated High (CVSS 8.8) in the CNA record. An attacker with a low-privileged account and remote access can inject operating system commands and execute them on the appliance, which can lead to full compromise of confidentiality, integrity and availability. The attack requires valid low-privileged credentials, and the same Dell advisory DSA-2026-416 also contains unauthenticated flaws that are more severe.

Affected

• Feature Release 7.7.1.0 through 8.8 (upper bound to be confirmed in the Dell advisory)
• LTS2024 release 7.13.1.0 through 7.13.1.80
• LTS2025 release 8.3.1.0 through 8.3.1.40
• LTS2026 release 8.6.1.0 through 8.6.1.20

Fixed in

• Per secondary sources (not yet verified against the Dell advisory): DD OS 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later
• Check the Dell advisory DSA-2026-416 for the authoritative list.

Workaround

Unknown. No workaround has been verified. Patching is the remediation path.

Exploitation

• Not listed in the CISA KEV catalog.
• Dell has not reported exploitation.
• No public exploit code has been confirmed.
• EPSS: 2.17 % (percentile 82).
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Identify all Data Domain systems in your environment and check their DD OS versions against the affected ranges.
• Apply the Dell update from DSA-2026-416 as part of the critical update cycle. Patch the whole advisory, not only this CVE.
• Prioritise systems that are reachable from untrusted networks or that share credentials with other systems.
• Restrict management access to backup administrators and do not expose the management interface to the internet.
• Review accounts with access to the appliance and monitor for unusual commands or logins.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Dell DSA-2026-416 Security Update www.dell.com
• VulDB CVE-2026-86396 vuldb.com
• Brandefense: Dell Data Domain critical vulnerabilities (DSA-2026-416) brandefense.io
• Radar Offseq: CVE-2026-86396 OS command injection radar.offseq.com
• Strix AI: CVE-2026-86396 www.strix.ai
• ThreatInt: CVE-2026-86396 cve.threatint.com
• TheHackerWire: CVE-2026-86396 www.thehackerwire.com
• SecurityOnline: Dell PowerProtect Data Domain vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:36.