What is CVE-2026-86384?

CVE-2026-86384 is a critical-severity vulnerability in Dell Powerprotect Data Domain, classified under Use of Hard-coded Cryptographic Key. CVSS score: 9.8/10. Published 2026-10-28.

How severe is CVE-2026-86384?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Dell Powerprotect Data Domain

CVE-2026-86384

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.

Published 2026-10-28 · last modified 2026-10-28.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (42.6th percentile), scored 2026-10-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 42.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Dell Powerprotect Data Domain

Weakness classification (CWE)

CWE-321 — Use of Hard-coded Cryptographic Key

References

www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-del… (vendor-advisory)

Frequently asked questions

What is CVE-2026-86384?: CVE-2026-86384 is a critical-severity vulnerability in Dell Powerprotect Data Domain, classified under Use of Hard-coded Cryptographic Key. CVSS score: 9.8/10. Published 2026-10-28.
How severe is CVE-2026-86384?: Critical severity. CVSS v3 base score is 9.8 out of 10.