CVE-2026-86386

MEDIUM4.3

Published 2026-10-28 · Source security_alert@emc.com

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-89

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-87880
Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 6.8
CVE-2026-87879
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 5.9
CVE-2026-87878
Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.
2026-10-28 · score 6.3
CVE-2026-87101
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 6.2
CVE-2026-87099
Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
2026-10-28 · score 5.7