Dell PowerProtect Data Domain Management Center CVE-2026-86386

Exploitation requires a valid low-privileged authenticated account on the PowerProtect Data Domain Management Center (CVSS PR:L), reachable over the network with no user interaction (AV:N/UI:N). The affected feature, endpoint, or parameter carrying the SQL injection is not described in the available sources. Limiting factors: the attacker must first obtain credentials on this management appliance, and impact is confined to information disclosure (C:L; no integrity or availability impact), so the flaw cannot by itself alter data or disrupt service. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; fixed versions are 8.9.0.0, 7.13.1.90, 8.3.1.50, and 8.6.1.30. Per the vendor, applying the update is the remediation.

This is a moderate-severity, lower-priority issue rather than an urgent emergency. The CVSS 3.1 base score of 4.3 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable flaw of low attack complexity, but it requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - consistent with the description's 'low privileged attacker with remote access ... Information disclosure.' There is no public exploit identified at time of analysis: no POC or exploit reference appears in the input, no CVSS or description signal contradicts the other, and the sources are internally consistent. The vuln.today decision label is 'this_month,' aligning with a patch-on-normal-cycle posture rather than act_now/emergency. KEV status is not indicated (not confirmed exploited), and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. The requirement for valid low-privilege credentials on a backup-management appliance meaningfully limits the realistic attacker population. Net: a genuine but modest risk best addressed during routine patching, not a drop-everything event.

An attacker who already holds a valid low-privileged account on the PowerProtect Data Domain Management Center web interface sends crafted input to an affected parameter, injecting SQL that the backend fails to neutralize. Because the attack vector is network-based with low complexity (AV:N/AC:L) but requires authentication (PR:L), the attacker reads database contents they should not be able to see, disclosing sensitive information. No public exploit code was identified at time of analysis.