Dell PowerProtect Data Domain: Improper authentication allows privileged accounts

Summary

Dell PowerProtect Data Domain (DD OS) backup appliances in several release lines contain a critical flaw that allows unauthenticated attackers with network access to create privileged accounts. An attacker who can reach the management interface could gain complete control of the system, including access to backup data. Dell rates the CVSS v3.1 base score at 9.8. The CVE record classifies the weakness as CWE-862 (Missing Authorization), while the description calls it an improper authentication issue.

Affected

• Feature Release 7.7.1.0 through 8.8
• LTS2024 7.13.1.0 through 7.13.1.80
• LTS2025 8.3.1.0 through 8.3.1.40
• LTS2026 8.6.1.0 through 8.6.1.20
• Data Domain Management Center and Virtual Edition: unknown whether these share the same fixed builds

Fixed in

• Feature Release: 8.9.0.0 or later
• LTS2024: 7.13.1.90 or later
• LTS2025: 8.3.1.50 or later
• LTS2026: 8.6.1.30 or later

(Per the CVE record and secondary sources citing Dell DSA-2026-416; verify against the Dell advisory before patching.)

Workaround

Unknown. No workaround is documented in the sources reviewed. Restricting management interfaces to an isolated admin network is interim hardening only.

Exploitation

• Not listed in the CISA KEV catalog; no known exploitation in the wild
• Dell has not reported exploitation
• No public proof-of-concept found as of the source dates
• CISA SSVC: exploitation none, automatable yes, technical impact total

Our recommendation

• Identify all Data Domain systems, Virtual Editions and Management Center instances and their DD OS versions.
• Patch as a priority to the fixed build for your release line, after confirming it in the Dell advisory DSA-2026-416.
• Until patched, ensure management interfaces are not reachable from the internet and are placed on an isolated admin network.
• Review admin accounts for unexpected privileged users.
• Monitor the KEV catalog and the Dell advisory for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Dell DSA-2026-416 Security Update www.dell.com
• CVE record summary with product status (threatint) cve.threatint.com
• Brandefense: Dell Data Domain critical vulnerabilities brandefense.io
• SecurityOnline: Dell PowerProtect Data Domain vulnerabilities securityonline.info
• VulDB CVE-2026-86397 vuldb.com
• TheHackerWire: CVE-2026-86397 www.thehackerwire.com
• Offseq Radar: CVE-2026-86397 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:16.