External risk intelligence

Dell PowerProtect Data Domain Improper Authentication Leading to Privileged Account Creation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-86397

Dell PowerProtect Data Domain is an enterprise data protection appliance typically managed through web-based administrative interfaces or APIs. While intended for internal data center use, these management surfaces are frequently exposed to broader network segments or reachable via remote access configurations, increasing the likelihood of exposure.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Dell PowerProtect Data Domain, which could allow an unauthenticated remote attacker to create privileged accounts and gain complete control of the system. This type of access to data protection systems could have significant implications for business continuity and data security.

Unauthorized access could lead to full system compromise.
Protects critical business data and operational continuity.
Confirm relevance and exposure to safeguard data.

Attack Path

How an attacker could exploit the issue

An attacker could exploit an improper authentication flaw in Dell PowerProtect Data Domain by remotely accessing the system. This access would allow them to bypass normal authentication controls and potentially create privileged accounts, giving them full control over the affected system.

No authentication required to attack.
Remote network access triggers vulnerability.
Full system control possible for attacker.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with remote access could potentially create privileged accounts on Dell PowerProtect Data Domain systems, allowing them to take complete control.

System access and control at risk.
Exploitable via remote unauthenticated access.
Complete system compromise possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dell PowerProtect Data Domain systems are likely managed by infrastructure or platform teams, with vendor management involved for patch releases. The immediate priority is to inventory all PowerProtect Data Domain instances, confirm their network exposure and criticality, and identify the specific system owners responsible for remediation. This will enable a risk-based approach to planning upgrades or applying necessary security measures.

Infrastructure and platform teams should own this.
Verify system exposure and business criticality.
Plan for earliest opportunity upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dell PowerProtect Data Domain?

It is an enterprise-grade data protection appliance used by organizations to perform deduplication, backup, and recovery tasks. It serves as a centralized repository for storing critical business data, often managed through web interfaces or APIs that control how data is backed up and accessed.

What does Improper Authentication mean for CVE-2026-86397?

This weakness, categorized as CWE-862, means the system fails to properly verify who is trying to access it. For this CVE, it specifically allows an attacker to bypass standard login requirements, enabling them to create a new privileged account and gain full administrative control over the appliance without needing existing credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by remotely connecting to the vulnerable system over a network. The vulnerability does not require any prior authentication or special user interaction to initiate. Conversely, an attacker cannot trigger this if they lack network connectivity to the appliance's management interface.

Is my Data Domain system at risk?

Halo Surface Signal indicates that while these appliances are typically used internally, their management interfaces are frequently reachable via broader network segments or remote access setups. You should consider your system relevant if the administrative interface is accessible from outside your primary, secured management network.

What should I do if I run this technology?

First, inventory all instances of Dell PowerProtect Data Domain in your environment to identify affected versions. Verify which systems have network-reachable management interfaces. Once identified, work with your infrastructure or platform teams to plan and apply the vendor-recommended software upgrades as your highest priority.

References

www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.