PowerProtect Data Domain CVE-2026-86397

No special conditions stated by the vendor - the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description indicate remote, unauthenticated exploitation leading to privileged account creation on affected Dell PowerProtect Data Domain versions (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, LTS2026 8.6.1.0-8.6.1.20). The practical limiting factor is network reachability of the appliance's management/control interface: Data Domain systems are commonly deployed on segmented internal management or backup networks, so an attacker must be able to route to that interface. No required user interaction, authentication, or non-default configuration is identified. The exact flaw in the authentication mechanism is not described in the available sources.

All available signals point to genuine high priority rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, and the vuln.today decision label is 'act_now', reinforcing urgency. The impact is unambiguous: improper authentication allows an unauthenticated remote attacker to create a privileged account, yielding complete system control over an enterprise backup/deduplication appliance - a high-value target because it holds backup data and is central to recovery. However, several corroborating signals are absent: no EPSS probability was supplied, there is no CISA KEV listing, and no public PoC or exploit reference is provided, so there is no evidence of active exploitation or weaponization at this time. The practical exposure depends heavily on whether the appliance's management interface is reachable by the attacker, since Data Domain systems are typically confined to internal management or backup networks. Net assessment: treat as a real, high-urgency patching priority driven by the unauthenticated full-compromise impact and the act_now label, while recognizing that exploitation likelihood data (EPSS/KEV/PoC) is simply missing, not confirmed low.

A remote attacker who can reach the PowerProtect Data Domain management interface abuses the improper authentication flaw to create a new privileged account without supplying valid credentials. Using that account, the attacker logs in and gains complete administrative control of the appliance and its backup data. No public exploit code is referenced in the available sources, and the exact trigger mechanism is not described.