{"id":"CVE-2026-86384","published":"2026-10-28T10:17:09.433","lastModified":"2026-10-29T04:18:42.203","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Dell PowerProtect Data Domain appliances contain a hard-coded cryptographic key used for encryption, allowing unauthenticated attackers to decrypt sensitive credentials and gain unauthorized access with compromised user privileges.","exploitability":"Exploitation is straightforward for an unauthenticated remote attacker due to the lack of authentication requirements and the presence of a fixed cryptographic key.","blast_radius":"Successful exploitation could lead to full system compromise, including unauthorized data access, modification, and potential lateral movement within the environment.","remediation":"Upgrade to Dell PowerProtect Data Domain LTS2026 release version 8.6.1.21 or later, as this version resolves the hard-coded key vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["hardcoded-key","credential-theft","remote-exploit","cryptography-flaw"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:41:21.196Z"}}