Dell has disclosed a critical flaw in its PowerProtect Data Domain backup appliances that could let an attacker with no login run commands as root. The vulnerability, tracked as CVE-2026-86400 and rated 9.8 out of 10, is an improper authentication weakness in Dell's advisory DSA-2026-416. The CVE record says an unauthenticated attacker with remote access could take complete control. Dell has urged customers to upgrade at the earliest opportunity, with no exploitation reported at the time of the 28 October brief.

Why backup systems are a prime target

Backup appliances are an especially sensitive target: they hold the copies organisations rely on to recover after a ransomware attack, so compromising one can undermine recovery and expose stored data. The flaw affects a wide range of versions: Feature Releases 7.7.1.0 through 8.8, LTS2024 releases 7.13.1.0 through 7.13.1.80, LTS2025 releases 8.3.1.0 through 8.3.1.40, and LTS2026 releases 8.6.1.0 through 8.6.1.20. The same advisory also covers related Data Domain and Management Center flaws.

What to do now

Dell lists fixed versions including DD OS 8.9.0.0 in the Feature Release line, 7.13.1.90 for LTS2024, 8.3.1.50 for LTS2025 and 8.6.1.30 for LTS2026, or later. Administrators should apply the update promptly and keep backup management interfaces off the open internet, on an isolated network, with a separate admin account not tied to everyday domain logins. No public exploit code had been confirmed at the time of writing, but attackers study 9.8-rated root flaws in backup kit quickly, so patching should not wait for exploitation evidence.

Sources: CVEFeed (CVE-2026-86400), Carthage Electronics CVE brief, 28 October 2026.