Dell PowerProtect Data Domain Management Center CVE-2026-86391

Exploitation requires the attacker to already hold low-privilege remote access to the Dell PowerProtect Data Domain Management Center (PR:L), after which an authentication-bypass-by-spoofing flaw (CWE-290) can be abused to reach a denial-of-service outcome. The description does not name the exact feature, protocol, or configuration setting that is spoofable, so the precise trigger is not described in the available sources. Limiting factors: valid low-privilege access to the management console is a prerequisite (not fully unauthenticated), no user interaction is required (UI:N), impact is confined to integrity and availability with no confidentiality loss (C:N), and affected builds are specific version ranges - Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

This is a moderate-severity issue (CVSS 6.4) whose signals are internally consistent and point to a limited, non-urgent risk rather than a top priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) indicates a network-reachable flaw of low attack complexity, but it requires existing privileges (PR:L), carries no confidentiality impact (C:N), and only low integrity and availability impact - the description confirms the outcome is denial of service. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the moderate score. No EPSS probability, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no evidence of active exploitation or available exploit code. The only supplied signals are the vendor-assigned CVSS and the Dell advisory; EPSS and SSVC exploitation/automatable data are MISSING, so real-world exploitation likelihood cannot be quantified from the input. Net: a genuine but contained issue - authenticated DoS against a backup-management console - that warrants scheduled patching rather than emergency response.

A low-privileged user who already has remote, authenticated access to the PowerProtect Data Domain Management Center exploits the authentication-bypass-by-spoofing weakness to impersonate another identity or component and drive the console into a denial-of-service state, disrupting backup management. No public exploit code or PoC reference is present in the input. Because the CVSS scope is changed (S:C), the disruption may extend beyond the directly vulnerable component.