PowerProtect Data Domain CVE-2026-86399

Exploitation requires the attacker to already hold high (administrative) privileges on the Dell PowerProtect Data Domain appliance (CVSS PR:H) and network access to the management interface; no user interaction is needed (UI:N). The specific product feature or command that improperly neutralizes special elements is not named in the available sources, so the exact trigger is not described in the available sources. Limiting factors: the high-privilege prerequisite sharply narrows the realistic attacker set to credentialed admins, compromised admin accounts, or insiders; the affected set is bounded to the listed Feature Release (7.7.1.0 through 8.8), LTS2024 (7.13.1.0-7.13.1.80), LTS2025 (8.3.1.0-8.3.1.40), and LTS2026 (8.6.1.0-8.6.1.20) version ranges.

This is a moderate-severity, high-barrier issue rather than an urgent widespread threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes an OS command injection reachable over the network but gated by PR:H - the attacker must already hold high (administrative) privileges on the appliance, which is the dominant limiting factor. Impact is full (C:H/I:H/A:H) because command execution on a backup/dedup appliance can compromise stored data and the system itself. No EPSS score, KEV listing, or PoC was provided in the input, so there is no signal of active or probable exploitation: exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_week,' indicating a near-term remediation priority but not emergency/act_now urgency. Net: a genuine privilege-escalation/post-authentication risk worth patching on a prompt (this-week) cadence, but the PR:H requirement makes it meaningfully lower real-world risk than an unauthenticated RCE of similar score. Note that the CVSS vector lists AV:N yet the flaw requires an already-high-privileged operator, so the practical exposure is to attackers who have compromised admin credentials or to malicious/compromised insiders - verify the exact remote-access surface with the Dell advisory.

An attacker who has already obtained high-privilege (administrative) access to a Dell PowerProtect Data Domain appliance - via stolen admin credentials or an insider - submits crafted input to a feature that passes it into an OS command, injecting attacker-controlled shell commands. The injected command runs on the appliance, giving full command execution and potential compromise of backup data integrity and availability. No public exploit code was identified in the provided data, and the network vector still presupposes the high privilege level from the CVSS vector.