PowerProtect Data Domain CVE-2026-86395

Exploitation requires an attacker who already holds high-privileged (administrative) access to the Dell PowerProtect Data Domain appliance (CVSS PR:H), reached over the network (AV:N) with no user interaction (UI:N). This privilege prerequisite is the primary limiting factor, confining realistic abuse to malicious administrators or attackers who have already obtained admin credentials. The available sources do not name the exact command, feature, configuration setting, or interface that is injectable, so the precise trigger is not described in the available sources. Affected builds are enumerated: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 (Virtual Edition).

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H) scores 7.2 (High) and shows the key gating factor is PR:H - exploitation requires an already high-privileged account on the appliance, which substantially narrows the realistic attacker population to insiders or anyone who has already compromised administrative credentials. Attack complexity is low and no user interaction is needed, so once that privilege is held, exploitation is straightforward with full confidentiality, integrity, and availability impact on the unchanged scope (S:U). No EPSS score, CISA KEV listing, or public PoC/exploit reference is present in the supplied data, so there is no signal of active or widespread exploitation; the only priority signal is the vuln.today 'this_week' decision label, which aligns with a serious-but-not-critical, privilege-dependent bug. The dominant risk is post-compromise privilege-to-code escalation on a backup appliance, not opportunistic internet-wide attack. Note the input provides no EPSS, KEV, or POC data - their absence is not itself evidence of safety, but no exploitation evidence was supplied to weigh.

An attacker who already holds high-privileged (administrative) access to a Dell PowerProtect Data Domain Virtual Edition instance submits crafted input to an affected management interface that fails to neutralize special shell characters, injecting an OS command. Because attack complexity is low and no user interaction is required, the injected command runs on the appliance, giving the attacker arbitrary command execution. No public exploit code or PoC reference is provided in the available data.