CVE-2026-86384
Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Critical
- CVSS 9.8
- Fixed version listed
Summary
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability.
From the CVE record.
Read the original description
CVE record
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Dell PowerProtect Data Domain | before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later | 8.9.0.0 or later |
Advisories and fixes
- Vendor advisory www.dell.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by dell)
- Weakness
- CWE-321: CWE-321
- Vendor
- Dell, PowerProtect Data Domain
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.