PowerProtect Data Domain CVE-2026-86377

Exploitation requires network reachability to Dell PowerProtect Data Domain plus low-privilege authenticated access (CVSS PR:L) - it is NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The appliance must be running an affected release: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20. The specific feature, protocol, or interface that receives the malformed input is not described in the available sources, so the exact trigger surface cannot be named from this data. The principal limiting factor is the required low-privilege credential/access and the availability-only impact (service disruption rather than data compromise or code execution).

This is a moderate, defensively-prioritized issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, 7.6) indicates a network-reachable flaw with low attack complexity requiring only low-level authentication (PR:L) and no user interaction, with the dominant impact being high availability loss (A:H) consistent with the Out-of-bounds Write (CWE-787) and its stated Denial of Service outcome. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is NOT on CISA KEV and no proof-of-concept or exploit reference is present (only the Dell vendor advisory), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', signaling a near-term but non-emergency remediation priority - consistent with an authenticated, availability-only impact on an enterprise appliance rather than an unauthenticated remote code execution. The claimed confidentiality and integrity impacts (C:L/I:L) in the vendor vector are not explained by the description, which states only Denial of Service; this minor discrepancy should be verified against the full Dell advisory.

An attacker who already holds low-privilege credentials or access to the Data Domain management/data interface sends crafted input over the network that triggers the out-of-bounds write, corrupting memory and crashing or hanging the service. This disrupts backup and restore operations for the environment relying on the appliance. No public exploit code is known, and some form of authenticated access is required, which raises the bar for opportunistic attacks.