Dell PowerProtect Data Domain CVE-2026-86389

Exploitation requires a high-privileged (administrative) account on the Dell PowerProtect Data Domain appliance, as stated in Dell's description and reflected by PR:H in the CVSS vector - this is NOT remotely exploitable by an unauthenticated attacker. The attacker needs remote network access to the appliance's management/service interface (AV:N) but no user interaction (UI:N). Affected deployments: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The principal limiting factor is the prerequisite of existing administrative privilege, which confines realistic risk to insiders, compromised admin credentials, or chaining from another access vector; the specific feature/protocol or configuration that exposes the vulnerable integer-arithmetic path is not described in the available sources.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows network-reachable, low-complexity, no-user-interaction exploitation with full confidentiality/integrity/availability impact - but the decisive limiter is PR:H: exploitation requires an attacker who already holds high (administrative) privileges on the appliance, which Dell's own description confirms ('A high privileged attacker with remote access'). That single metric moves this from a perimeter threat to a post-authentication or insider/credential-theft escalation scenario. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT on CISA KEV and no proof-of-concept or exploit reference is present (the sole reference is the Dell vendor advisory), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week', consistent with a High-severity authenticated RCE in an enterprise backup appliance that warrants prompt but not emergency patching. Signals are mutually consistent: high technical impact, but the PR:H precondition and absence of KEV/PoC evidence keep real-world risk moderate and gated on prior privileged access.

An attacker who has already obtained high-privileged (administrative) access to a Dell PowerProtect Data Domain appliance - via stolen admin credentials, a compromised management session, or a malicious insider - sends crafted input over the network to a component that mishandles integer arithmetic, triggering a wraparound that corrupts memory and yields code execution on the appliance. No public exploit code is identified at time of analysis, and the specific trigger is not described in the available sources. Because the appliance stores backup data, successful execution could compromise the integrity and recoverability of protected backups.