Dell PowerProtect Data Domain (enterprise backup appliances) and Oracle E-Business Suite (enterprise finance and operations software) both have critical fixes out. Most small businesses don’t run either, but if you or your clients do, patch them. Neither set of flaws is in CISA’s Known Exploited Vulnerabilities catalog.
Dell PowerProtect Data Domain
What happened: Dell’s advisory DSA-2026-416 fixes dozens of flaws in DD OS, the software on Data Domain appliances, Data Domain Virtual Edition, APEX Protection Storage and Data Domain Management Center. Dell rates four of them 9.8 (critical). CVE-2026-86400 lets an unauthenticated remote attacker run commands as root, CVE-2026-86397 lets one create a privileged account, CVE-2026-86384 is a hard-coded cryptographic key that can expose credentials, and CVE-2026-103780 is a buffer overflow that allows remote command execution. Dell rates a fifth, CVE-2026-90717 in Management Center, 9.1; it could affect other managed Data Domain systems. Dell rates two more, CVE-2026-103792 and CVE-2026-103799, 9.6. All three of these Management Center flaws need a low-privileged login.
Who is affected: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40 and LTS2026 8.6.1.0 through 8.6.1.20.
Exploitation: Dell’s advisory doesn’t report any attacks, and we found no report of these flaws being used.
Oracle E-Business Suite
What happened: Oracle’s October 2026 Critical Patch Update, released October 20 (US time), fixes CVE-2026-101767 in the Application Object Library of E-Business Suite 12.2.3 through 12.2.15. Oracle rates it 9.8 and says an unauthenticated attacker with network access over HTTP can exploit it easily and take over the Application Object Library.
Exploitation: Not confirmed. Threat intelligence firm Defused said on X on October 27 that its Oracle E-Business Suite decoy servers had recorded “exploratory exploits” against the flaw that morning; SecurityWeek later reported the claim. Oracle and CISA have not confirmed attacks, and CISA’s own assessment in the NVD record, dated October 21, lists exploitation as “none”.
Why it matters
Backup systems are a target because attackers who control them can delete the copies you’d need to recover from ransomware. SecurityWeek notes that Oracle E-Business Suite flaws are often targeted by attackers.
What to do
Our advice, based on the vendor advisories:
- Data Domain: upgrade DD OS to 8.9.0.0 (Feature Release), 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) or 8.6.1.30 (LTS2026) or later, including Management Center and Virtual Edition.
- Oracle EBS: apply the October 2026 Critical Patch Update to 12.2.3 through 12.2.15.
- Keep management interfaces and EBS off the open internet; allow access only from admin networks or a VPN.
- Check for accounts you didn’t create on Data Domain systems, and review EBS web logs from October 27 on for unusual requests.
- If you’re an MSP, list which clients run either product and confirm each upgrade.
Sources
| Source | What it confirms | Link |
|---|---|---|
| Dell DSA-2026-416 (rev. 3.0, Oct 19, 2026) | Flaws, Dell’s CVSS 3.1 scores, affected and fixed versions | https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities |
| NVD CVE-2026-86400 | Published Oct 28, 2026; CVSS 9.8 from Dell (NVD not yet scored) | https://nvd.nist.gov/vuln/detail/cve-2026-86400 |
| Oracle Critical Patch Update Advisory, October 2026 | CVE-2026-101767, Oracle’s 9.8 score, versions 12.2.3-12.2.15 | https://www.oracle.com/security-alerts/cpuoct2026.html |
| NVD CVE-2026-101767 | CVSS 9.8 from Oracle (NVD not yet scored); CISA SSVC exploitation “none” (Oct 21) | https://nvd.nist.gov/vuln/detail/cve-2026-101767 |
| Defused on X (Oct 27, 2026) | Probing seen on its decoys, unconfirmed | https://x.com/DefusedCyber/status/2115099999973364147 |
| SecurityWeek (Oct 28, 2026) | Secondary report of Defused’s probing claim | https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/ |
| CISA KEV catalog (version 2026.10.27) | None of these CVEs listed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
Last checked: Oct 28, 2026, 6:17 p.m. Manila (UTC+8). Method: We read Dell’s and Oracle’s advisories and checked each CVE against NVD and CISA’s KEV catalog (version 2026.10.27). How we work
Updates
- Oct 28, 2026, 10:35 p.m. Manila: First published.
Spotted an error? See our corrections policy and tell us.
