CVE-2026-86401

LowCVSS 2.7/10Last modified Nov 3, 2026

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DellPowerProtect Data Domain Management Center< 8.9.0.0 or later; < 7.13.1.90 or later; < 8.3.1.50 or later; < 8.6.1.30 or later

References

Timeline

Published
Oct 28, 2026
Last modified
Nov 3, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-864048.8EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoaCVE-2026-864059.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS MoCVE-2026-864067.5The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, anCVE-2026-864073.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation paCVE-2026-864086.5Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()CVE-2026-864098.1Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tranCVE-2026-864108.1A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, anCVE-2026-864119.1An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-864128.1A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-864139.1When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credenCVE-2026-864149.1An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-864157.5libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann
CVE-2026-86401: Low severity, CVSS 2.7 | Vulnix