PowerProtect Data Domain CVE-2026-86392

Exploitation requires the attacker to already hold high-privileged (administrative) access to the Dell PowerProtect Data Domain appliance (PR:H), reachable over the network (AV:N). Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The principal limiting factor is the high-privilege prerequisite: an unprivileged or external attacker cannot trigger it, which confines realistic risk to compromised or malicious administrators. No user interaction is required (UI:N), and the available sources do not describe any additional feature or configuration prerequisite beyond administrative access.

This is a genuine but low-urgency issue. The CVSS base score is 4.9 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H tells a consistent story: although the attack vector is network (AV:N) with low complexity (AC:L), exploitation requires high privileges (PR:H) and yields only availability impact (A:H), with no confidentiality or integrity loss (C:N/I:N). In practical terms an attacker must already hold a high-privileged administrative role on the appliance to crash it - a significant barrier that caps real-world risk. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, and no public exploit or proof-of-concept reference is present (the only reference is Dell's own advisory). The vuln.today priority 'this_month' aligns with this profile: worth patching in a normal maintenance cycle, not an emergency. There is no signal conflict here - every signal (medium CVSS, DoS-only impact, high-privilege requirement, no KEV, no POC) points the same direction: a real but low-priority, privilege-gated denial-of-service issue rather than a widely-exploitable critical flaw.

An attacker who has already obtained high-privileged (administrative) access to a Dell PowerProtect Data Domain appliance sends crafted input over the network that triggers a heap-based buffer overflow, crashing the service and denying backup/restore availability. No public exploit code or PoC is identified, and the specific trigger is not described in the available sources. Because high privileges are required, this is most plausible as an insider-abuse or post-compromise scenario rather than opportunistic external exploitation.