CVE-2026-86397

{
  "etk_id": "ETK-2026-2849",
  "cve_id": "CVE-2026-86397",
  "display_id": "CVE-2026-86397",
  "ghsa_id": "GHSA-gvg7-47g3-qv5v",
  "euvd_id": "EUVD-2026-111841",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authentication in PowerProtect Data Domain",
  "summary": "PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.8 and affected LTS 2024, 2025, and 2026 releases are impacted. An unauthenticated remote attacker may create a privileged account when they can reach the affected system remotely.",
  "mitigation": "Upgrade to 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, or 8.6.1.30 or later, as appropriate for your release train. Until upgraded, restrict remote access to the appliance to trusted administrative networks.",
  "vendor": "Dell",
  "product": "PowerProtect Data Domain",
  "affected": [
    {
      "affected_notes": [
        ">= 0, < 8.9.0.0 or later",
        ">= 0, < 7.13.1.90 or later",
        ">= 0, < 8.3.1.50 or later",
        ">= 0, < 8.6.1.30 or later"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [
        "8.9.0.0 or later",
        "7.13.1.90 or later",
        "8.3.1.50 or later",
        "8.6.1.30 or later"
      ],
      "package_name": "PowerProtect Data Domain",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 15.611952116666666,
  "t0_at": "2026-10-28T09:02:11.392000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T10:24:47.810041+00:00",
      "days": 0.057365949548611114,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T09:02:11.392000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T09:02:11.392000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T09:02:11.392000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86397"
    }
  }
}