Dell PowerProtect Data Domain CVE-2026-86394

Exploitation requires the attacker to already possess high-privileged (administrative) access to the PowerProtect Data Domain system per PR:H in the CVSS vector; it is not exploitable by an unauthenticated or low-privileged remote attacker. Access is over the network (AV:N) at low complexity (AC:L) with no user interaction (UI:N). The exact product feature, management command, or interface that fails to neutralize OS command metacharacters is not described in the available sources, so the precise trigger cannot be confirmed. The dominant limiting factor is the administrative privilege prerequisite, which narrows realistic risk to insiders or attackers who have already compromised admin credentials. Affected: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.

This is a genuine but conditional priority, not a high-CVSS-but-trivial-risk case. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N: the flaw is reachable over the network at low attack complexity, but the PR:H metric means exploitation requires an already high-privileged (administrative) account on the PowerProtect Data Domain system, which is the single most important limiting factor. Impact is severe where the precondition is met - C:H/I:H/A:H reflects full command execution on the appliance. Signal cross-reference: the vuln.today decision label is 'this_week' (patch promptly, not an emergency), and the vulnerability was self-reported by Dell. CISA KEV status is not indicated (treat as not listed), no EPSS exploitation-probability score was supplied, and no POC or exploit reference is present in the input - so there is no evidence of active or likely-imminent exploitation. The main caveat: because the attack requires PR:H, real-world risk is dominated by insider threat or an attacker who has already compromised admin credentials, rather than by opportunistic unauthenticated scanning. EPSS and KEV data being absent means the 'this_week' label rests on severity and vendor reporting rather than observed exploitation.

An attacker who already holds high-privileged (administrative) remote access to a Dell PowerProtect Data Domain appliance - for example via stolen operator credentials or an insider - submits input containing improperly neutralized shell metacharacters to an affected management function, causing injected OS commands to run on the underlying system. Because AC:L and AV:N apply, the action is network-reachable and not complex once the privileged session exists. No public exploit code or POC reference is present in the supplied data.