Dell has disclosed a PowerProtect Data Domain flaw affecting the appliance that holds many organizations’ backup copies, rated 9.8 out of 10 according to the NVD entry. No exploitation is reported to date in that entry, and Dell recommends that customers upgrade their appliances as soon as possible.
What is it?
A failed identity check would let someone without an account, from outside the network, create an administrator account on the backup appliance.
The vulnerability CVE-2026-86397 is a case of broken authentication. Authentication is the check that confirms a person is who they claim to be, much like the lock on a cottage you close up for winter: you lock the door, you leave with peace of mind, assuming only your key opens it. Here, the lock has a flaw: according to the NVD entry, an unauthenticated attacker with remote access could create a privileged account for themselves, in other words cut their own house key and come back whenever they want. And that particular cottage happens to be exactly where the company stores its backup copies.
Why is it serious?
The score is 9.8 out of 10 according to the NVD entry, and the target is the system that holds your backups.
This CVSS 3.1 score of 9.8 out of 10 was assigned by the reporting organization (CNA), according to the NVD entry. That same entry states the flaw would let an attacker take full control of the system. In business terms, this means three things: company data can be exfiltrated, which means a breach to disclose; backups can be tampered with, which means a much longer recovery after an incident; and the safety net you count on to restart is no longer reliable.
The NVD entry reports no exploitation to date. That is not a reason to wait: the storm has already been called in the forecast, and there is still time to bring the patio chairs in. Worth noting as well, another vulnerability in the same product, CVE-2026-86400, is listed at the same severity level for the same period.
Who is affected?
Dell PowerProtect Data Domain appliances across several version lines, used mainly as the central backup system.
The affected versions, according to the NVD entry: Feature Release 7.7.1.0 through 8.8; LTS2024 7.13.1.0 through 7.13.1.80; LTS2025 8.3.1.0 through 8.3.1.40; LTS2026 8.6.1.0 through 8.6.1.20. The entry does not specify the fixed version, so you should rely on Dell’s official advisory for the exact upgrade target. This type of appliance is common in organizations that manage large volumes of data: manufacturers, carriers, distributors, clinics, professional firms, municipalities. In a small or mid-sized business, it is often installed and maintained by an IT provider, and management does not always know its name.
How do I check my business?
Four simple questions are enough to know whether you are affected, and most of them belong with your IT provider.
- Ask whether the business uses a PowerProtect Data Domain appliance and, if so, its exact version (management, with the IT provider).
- Confirm that the appliance’s administration interface is not reachable from the Internet (IT provider or software vendor).
- Review the list of administrator accounts and flag any privileged account created recently without a known reason (IT provider).
- Confirm that a recent backup copy exists somewhere other than the backup system itself (management).
Scenario
Fictional example: a dental clinic on Montreal’s South Shore has not upgraded its backup appliance.
On a Monday morning, patient files won’t open. The backup appliance, the one meant to restore everything, was hit too: the backup copies are no longer reliable. The day’s appointments are cancelled, the receptionist calls patients one by one, and the week’s X-rays have to be redone. Treatments resume, but the clinic has to explain to its patients what happened to their health information.
What the PowerProtect Data Domain Flaw Means for a Canadian Organization
Law 25 obligations apply wherever personal information is stored, including inside a backup system.
In Quebec, a personal information breach is not just an internal matter: Law 25 requires organizations to keep a register of confidentiality incidents and, where there is a risk of serious harm, to notify the affected individuals and the Commission d’accès à l’information (Quebec’s access-to-information and privacy regulator). When the system affected is the backup system itself, both your ability to restart and the evidence of what happened are weakened.
What to do now
- Take inventory of your backup appliances and their versions, with your IT provider.
- Remove any administrative access to these appliances from the Internet and restrict it to the internal network.
- Apply the upgrade recommended by Dell, following the manufacturer’s official advisory.
- Review the appliance’s privileged accounts and investigate any unexplained additions.
- Keep a backup copy isolated from the backup system itself and test a restore.
FAQ
No one has attacked us, can we wait until spring?
The NVD entry reports no exploitation to date, which is good news, not permission to wait. A flaw rated 9.8 out of 10 in that same entry draws attention, and a backup appliance is a prime target. Dell recommends upgrading as soon as possible: that is the window you have, and no one can say how long it stays open.
Our appliance isn’t connected to the Internet, are we fine?
That is a good practice, and it significantly reduces exposure. But access can exist without anyone knowing: a remote-support link, a firewall rule left open, a compromised internal workstation. Have your IT provider confirm the situation in writing, then apply the upgrade regardless. No protection is absolute, and be wary of any claim that promises zero risk.
What should we do if personal information is exposed?
Log the incident in your register, assess the risk of serious harm, and notify the affected individuals as well as the Commission d’accès à l’information when that risk is present. Document the actions taken and their dates. The baseline cyber security controls published by the Canadian Centre for Cyber Security provide a useful checklist to prepare for this situation before it happens.
Sources
- NVD entry for CVE-2026-86397 · NIST, October 28, 2026
- Security advisory (dell.com) · dell.com
- Canadian Centre for Cyber Security: baseline cyber security controls for small and medium organizations · baseline reference checklist
- Commission d’accès à l’information du Québec · obligations, incident register and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-86397
This article was prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial policy.
