Dell Data Domain: unauthenticated root RCE (CVE-2026-86400)
Dell patches a critical PowerProtect Data Domain flaw: a remote unauthenticated attacker gains root command execution. A fix ships in DSA-2026-416.
Who is affected
- Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8
- LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20
- Data Domain backup appliances run by hotel groups, MSSPs or hosting providers on behalf of hotels for PMS, reservation and finance archives
How to fix
Deploy the fixed DDOS release named in Dell bulletin DSA-2026-416 for the installed branch, without waiting for the quarterly maintenance window. Hard-segment the management interface (web console, SSH) behind a dedicated firewall zone, with no direct or indirect Internet exposure. Review the appliance authentication and command logs back to October 28, 2026. Require every hosting provider or managed service partner operating a Data Domain for the hotel to confirm the patch in writing, with the installed version number.
What happened
The CVE-2026-86400 record was published on October 28, 2026 as part of Dell bulletin DSA-2026-416, which fixes a batch of flaws in Dell PowerProtect Data Domain, the vendor's disk backup platform. Four of the bulletin's seven critical flaws need no credentials at all, CVE-2026-86400 among them: an improper authentication weakness that lets a remote, unauthenticated attacker run arbitrary commands with root privileges, which is full control of the appliance. Dell rates the flaw critical at 9.8 on the CVSS 3.1 scale; NVD published the record on October 28 but had not completed its own analysis at the time of this advisory. No in-the-wild exploitation has been reported and the flaw is not in CISA's KEV catalog.
Why it matters to a hotel
Data Domain appliances are the last line of defense for many hotel groups and for properties that outsource backup: PMS archives, reservation databases, accounting, and MSSP-run backup estates. A root compromise of a backup appliance removes that last line and hands the intruder a vantage point over everything the backups cover, including credentials for the source systems. The management interface of these appliances typically lives on an operations network that is trusted but rarely segmented, widening what a compromised workstation, or the open Internet through an accidental exposure, can reach.
Who is affected
- PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.8.
- LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.
- Any organization, hotel or provider, whose estate includes a Data Domain in those ranges, rented managed hardware included: patch responsibility is a contract question, not an obvious one.
How to fix it
- Read Dell bulletin DSA-2026-416 and deploy the fixed DDOS release for the installed branch.
- Confirm the appliance's web console and SSH are reachable only from a dedicated management segment, never from guest or corporate networks or a broad hosting gateway.
- Review authentication and command logs back to October 28, 2026; investigate anything unusual.
- Ask the hosting provider or MSSP for written confirmation of the update, including the version now running.
- Use the exercise to perform a real restore test from the appliance: a backup nobody has tested is not insurance.
Context
DSA-2026-416 fixes seven critical, eighteen high and twenty-three medium or low issues across the Data Domain line, a sign of an urgent scrub of the platform's attack surface. On the same day, October 28, CISA added VMware ESXi and Linux kernel flaws to its KEV catalog, a reminder that virtualization and backup layers remain ransomware operators' priority targets. The full Dell bulletin is available through the vendor's support portal under reference 000515178.