PowerProtect Data Domain CVE-2026-86400

No special conditions stated - the description and CVSS vector (AV:N/AC:L/PR:N/UI:N) indicate remote unauthenticated exploitation of Dell PowerProtect Data Domain with no required privileges, user interaction, or non-default configuration named in the sources. The exploitation-limiting factor is network reachability: the attacker must be able to reach the affected appliance's remotely accessible (management/service) interface, so appliances that are network-isolated or segmented from untrusted networks are harder to reach. Affected trains are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; systems outside these version ranges are not in scope. The specific protocol, feature, or configuration that triggers the authentication bypass is not described in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with total compromise (C:H/I:H/A:H), and the description confirms the outcome is arbitrary command execution with root privileges via an improper authentication (CWE-287) flaw - an authentication bypass. The vuln.today decision label is 'act_now', and Dell (the reporting source) explicitly urges customers to upgrade at the earliest opportunity, both of which reinforce urgency. Signals that are MISSING rather than negative: no EPSS score was provided, this CVE is NOT listed as CISA KEV in the input, and no PoC or exploit reference is present, so there is no confirmation of active exploitation or public exploit code. The combination of unauthenticated network-reachable root command execution on a backup/data-protection appliance means the theoretical worst case is severe even though real-world exploitation prevalence is currently unquantified; the absence of EPSS/KEV data should be treated as unknown, not as evidence of low risk. The CVSS vector and the description are mutually consistent (both indicate remote unauthenticated full compromise), so there is no internal conflict to flag.

A remote attacker with network reachability to a Dell PowerProtect Data Domain appliance's management/service interface sends a request that bypasses authentication (CWE-287) and triggers command execution, gaining a root-level foothold without any credentials or user interaction. Because the appliance stores backup data, successful exploitation could enable destruction or exfiltration of backups and undermine recovery capability. No public exploit identified at time of analysis; the specific request or trigger mechanism is not described in the available sources.