What is CVE-2026-86395?

CVE-2026-86395 is a high-severity vulnerability in Dell Powerprotect Data Domain Virtual Edition, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-10-28.

How severe is CVE-2026-86395?

High severity. CVSS v3 base score is 7.2 out of 10.

RCE in Dell Powerprotect Data Domain Virtual Edition

CVE-2026-86395

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Vulnerability class: Command Injection (OS Command Injection)

Published 2026-10-28 · last modified 2026-10-28.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.022 (82.3th percentile), scored 2026-10-29.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 82.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Dell Powerprotect Data Domain Virtual Edition

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-del… (vendor-advisory)

Frequently asked questions

What is CVE-2026-86395?: CVE-2026-86395 is a high-severity vulnerability in Dell Powerprotect Data Domain Virtual Edition, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-10-28.
How severe is CVE-2026-86395?: High severity. CVSS v3 base score is 7.2 out of 10.