by Kastro
Paper/Archive/CVE-2026-86384

CVE-2026-86384

Dell PowerProtect Data Domain — Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.8.408 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.

Affected

ProductAffectedFixed inSource
PowerProtect Data Domain< 8.9.0.0 or later8.9.0.0 or laterCNA
PowerProtect Data Domain< 7.13.1.90 or later7.13.1.90 or laterCNA
PowerProtect Data Domain< 8.3.1.50 or later8.3.1.50 or laterCNA
PowerProtect Data Domain< 8.6.1.30 or later8.6.1.30 or laterCNA

Scores by source

dell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities