Dell PowerProtect Data Domain CVE-2026-86390

Exploitation requires the attacker to already possess a low-privileged, remotely-usable account on the Dell PowerProtect Data Domain appliance (PR:L in the CVSS vector), so this is an authenticated flaw, not an unauthenticated breach - valid or compromised low-level credentials are the key prerequisite that limits exposure. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; systems outside these ranges are not affected. The available sources do not state a specific feature, protocol, or non-default configuration that must be enabled, so the particular authorization-missing function is not described in the supplied evidence. Impact is confined to unauthorized data access (C:H) with no integrity or availability effect (I:N/A:N).

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity flaw that requires some existing low-level privilege (PR:L) and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with a Missing Authorization (CWE-862) flaw that lets an already-authenticated low-privilege user read data they should not be able to access. The vuln.today decision label is 'this_month', signaling a prioritized-but-not-urgent remediation window. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided in the input, so there is no signal of active exploitation or available exploit code; absence of these is not evidence they do not exist elsewhere, only that the supplied intelligence does not confirm them. Signals are internally consistent: the authenticated-but-remote, confidentiality-only profile points to an information-disclosure/authorization-bypass risk for environments where lower-privileged accounts exist, rather than a wormable unauthenticated breach. The main caveat is missing EPSS and the single vendor-sourced reference - risk scaling beyond the vendor's own advisory cannot be independently corroborated from the provided data.

An attacker who already holds a low-privilege account on a Dell PowerProtect Data Domain appliance (or who has obtained such credentials) sends crafted requests over the network to a function that fails to enforce authorization checks, retrieving data or accessing resources reserved for higher-privilege roles. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, exploitation is remote, low-complexity, and requires no victim interaction once minimal authenticated access exists. No public exploit identified at time of analysis, and the precise trigger is not described in the available sources.