PowerProtect Data Domain CVE-2026-86385

Exploitation requires a low-privileged but authenticated account on the Dell PowerProtect Data Domain appliance (CVSS PR:L), with network reachability to the appliance management/service interface. The underlying trigger mechanism - which specific operation or interface improperly checks dropped privileges - is not described in the available sources. Limiting factors: the attacker must already hold valid low-privileged credentials on the appliance, and only Feature Release versions 7.7.1.0 through 8.8 are affected (fixed in 8.9.0.0); no user interaction or non-default configuration is indicated as required.

This is a credible elevation-of-privilege issue that warrants prompt but not emergency action, consistent with the vuln.today 'this_week' decision label. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on an unchanged scope - a high base score of 8.8 that is internally consistent with CWE-273 (Improper Check for Dropped Privileges), where a process fails to verify that privileges were successfully relinquished, letting a low-privileged actor retain or regain elevated rights. No EPSS probability was supplied, so the likelihood of opportunistic mass exploitation cannot be quantified from this data. The CVE is NOT listed in CISA KEV and no PoC or exploit reference is present in the input, so there is no public exploit identified at time of analysis. The practical gate is that the attacker must already hold a low-privileged authenticated foothold on the appliance (PR:L), which narrows the realistic threat to insiders or attackers who have already gained an initial account - a meaningful limiter that tempers the raw 8.8 score for perimeter-protected deployments.

An attacker who already possesses a low-privileged authenticated account on a Dell PowerProtect Data Domain appliance (versions 7.7.1.0 through 8.8) reachable over the network leverages the appliance's failure to properly verify dropped privileges to retain or escalate to elevated rights. The low attack complexity and lack of required user interaction make exploitation straightforward once an account exists, but no public exploit code was identified in the available sources.