CVE-2026-86386
Received Received - Intake

SQL Injection in Dell PowerProtect Data Domain Management Center

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Dell

Description
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-86386
EUVD
EUVD-2026-111854

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. A low-privileged attacker with remote access could exploit it to disclose information by injecting malicious SQL commands.

Detection Guidance

Detection of this SQL injection vulnerability requires checking Dell PowerProtect Data Domain Management Center versions between 7.7.1.0-8.8, 7.13.1.0-7.13.1.80, 8.3.1.0-8.3.1.40, or 8.6.1.0-8.6.1.20. Use network scanning tools to identify affected versions and inspect web application logs for suspicious SQL query patterns or unusual input handling.

Impact Analysis

An attacker could exploit this to access sensitive data stored in the affected system, potentially leading to unauthorized information disclosure. The impact is limited to data exposure as the CVSS score indicates no integrity or availability impact.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected versions must address this to maintain regulatory compliance.

Mitigation Strategies

Immediately update Dell PowerProtect Data Domain Management Center to a patched version. If immediate patching is not possible, restrict remote access to the management interface, monitor for unusual SQL queries, and apply network-level protections like WAF rules to filter malicious inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86386. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart