CVE-2026-86399

HighCVSS 7.2/10Last modified Oct 30, 2026

Description

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	PowerProtect Data Domain	< 8.9.0.0 or later; < 7.13.1.90 or later; < 8.3.1.50 or later; < 8.6.1.30 or later

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Timeline

Published: Oct 28, 2026
Last modified: Oct 30, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-86403.5IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, CVE-2026-864009.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re CVE-2026-864012.7Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 CVE-2026-864048.8EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoa CVE-2026-864059.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Mo CVE-2026-864067.5The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, an CVE-2026-864073.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pa CVE-2026-864086.5Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()CVE-2026-864098.1Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran CVE-2026-864108.1A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an CVE-2026-864119.1An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-864128.1A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using