# Dell PowerProtect Data Domain multiple vulnerabilities fixed (DSA-2026-416, NCSC-2026-0460)

> Dell DSA-2026-416 / NCSC-NL NCSC-2026-0460 fix 38 vulnerabilities in Dell PowerProtect Data Domain, Data Domain Virtual Edition and Data Domain Management Center, including unauthenticated command execution, remote privileged account creation, root command execution via authentication bypass and hard-coded cryptographic keys (four CVEs at CVSS 9.8). No active exploitation or public PoC is stated in the sources.

- **Published:** 2026-11-01T07:22:33Z
- **Last reviewed:** 2026-11-01T07:22:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4974
- **ID:** TL-2026-4974
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-103780, CVE-2026-86384, CVE-2026-86397, CVE-2026-86400, CVE-2026-103792, CVE-2026-103799, CVE-2026-90717, CVE-2026-86378, CVE-2026-86385, CVE-2026-86396, CVE-2026-86398, CVE-2026-103779, CVE-2026-86377, CVE-2026-86379, CVE-2026-86380, CVE-2026-86389, CVE-2026-86393, CVE-2026-86394, CVE-2026-86395, CVE-2026-86399, CVE-2026-110540, CVE-2026-110541, CVE-2026-94346, CVE-2026-94347, CVE-2026-68866, CVE-2026-86383, CVE-2026-86390, CVE-2026-86391, CVE-2026-90720, CVE-2026-90726, CVE-2026-90728, CVE-2026-90729, CVE-2026-90730

## Description

Dell security advisory DSA-2026-416 (initial release 2026-10-01, revisions 2.0 on 2026-10-07 and 3.0 on 2026-10-19 per the Dell revision history) was summarized by NCSC-NL as NCSC-2026-0460 (published 2026-10-30, status Final, v1.0.0). The advisory covers 38 proprietary vulnerabilities in Dell PowerProtect Data Domain spanning stack-based buffer overflow, out-of-bounds write, OS command injection, SQL injection, path traversal, integer overflow, hard-coded cryptographic keys, improper authentication, authentication spoofing, improper privilege drop/management and missing authorization. NCSC-NL rates probability as Medium and impact as High. The advisory also lists many third-party component CVEs (Apache HTTP Server, OpenSSL, Python, Lodash, rsync, nginx, libexpat, curl, PostgreSQL libpq5, PKIXSSH and others) remediated through the updated system versions.

Seven vulnerabilities are rated Critical. Four score CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): CVE-2026-103780 (stack-based buffer overflow; an unauthenticated attacker with remote access can reach command execution), CVE-2026-86384 (use of hard-coded cryptographic key; credential exposure and privileged access without authentication), CVE-2026-86397 (privileged account creation by an unauthenticated remote attacker; Dell labels it Improper Authentication while the NCSC CSAF labels the weakness Missing Authorization) and CVE-2026-86400 (improper authentication allowing arbitrary command execution with root privileges). Three further Critical flaws are specific to Data Domain Management Center and affect managed systems with a changed scope: CVE-2026-103799 (missing authorization, CWE-862, CVSS 9.6), CVE-2026-103792 (SQL injection, CWE-89, CVSS 9.6) and CVE-2026-90717 (authentication bypass by spoofing, CWE-290, CVSS 9.1, privilege elevation affecting other Data Domain systems).

High-severity entries (CVSS 7.1-8.8) include CVE-2026-86378 (stack-based buffer overflow, CWE-121), CVE-2026-86385 (improper privilege drop, CWE-273), CVE-2026-86396 (OS command injection, CWE-78, AV:N/AC:L/PR:L, low-privileged remote attacker, EPSS 2.2% per OpenCVE), CVE-2026-86398 (path traversal, CWE-22), CVE-2026-103779 (improper authentication, 8.3), CVE-2026-86377 (out-of-bounds write, 7.6) and a cluster of 7.2-rated OS command injection (CVE-2026-86379, -86394, -86395, -86399, -110541), integer overflow (CVE-2026-86380, -86389), improper privilege management (CVE-2026-86393), path traversal (CVE-2026-94346) and process control (CVE-2026-94347) flaws, plus missing authorization CVE-2026-110540 (7.1). Medium entries (CVSS 6.0-6.8) are CVE-2026-68866, -86383, -86390, -86391, -90720, -90726, -90728, -90729 and -90730 (relative path traversal, path traversal, missing authorization, authentication bypass, improper integrity validation, privilege management and access control). The NCSC CSAF names 33 of the 38 proprietary CVE IDs; the remaining five are not enumerated in the retrieved sources.

Affected: DD OS Feature Release 7.7.1.0 through 8.8.0.0, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40 and LTS2026 8.6.1.0-8.6.1.20 (Data Domain Virtual Edition and Management Center are also affected). Fixed in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) and 8.6.1.30 (LTS2026) or later. Dell documents no workarounds beyond upgrading; the OpenCVE/NVD-derived description for CVE-2026-86396 and NCSC mention restricting remote access to trusted administrators as an interim measure. Context: this is not Dell's first critical Data Domain advisory this year; DSA-2026-278 (revision 3.0 dated 2026-07-09) covered two other unauthenticated CVSS 9.8 flaws (CVE-2026-53483, CVE-2026-53481), also with no confirmed exploitation or public PoC. Data Domain systems commonly hold backup data, so appliance compromise is a high-value position for an attacker; that is an analyst inference, not a source claim. The sources state no in-the-wild exploitation, no public PoC and no network IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1136.001 Local Account
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials

## Sources

- [NCSC-NL NCSC-2026-0460: Vulnerabilities Fixed in Dell PowerProtect Data Domain](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0460)
- [NCSC-NL NCSC-2026-0460 (CSAF)](https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0460.json)
- [Dell DSA-2026-416: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities)
- [OpenCVE: CVE-2026-86396](https://app.opencve.io/cve/CVE-2026-86396)
- [Veeam Community: DSA-2026-278 Multiple Vulnerabilities Fixed for Dell PowerProtect Data Domain (prior related advisory)](https://community.veeam.com/cyber-security-space-95/dsa-2026-278-multiple-vulnerabilities-fixed-for-dell-powerprotect-data-domain-13651)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4974