What is the CVSS score of CVE-2026-23777?

CVE-2026-23777 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23777?

Yes, a patch is available for CVE-2026-23777. Update the affected software to the latest version immediately.

Dell CVE-2026-23777

EUVD-2026-23411 MEDIUM

Information Exposure (CWE-200)

2026-04-17 dell

GHSA-x63q-987j-jrv7

Information Disclosure Dell

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 13:01 EUVD

Analysis Generated

Apr 17, 2026 - 12:13 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 12:00 euvd

EUVD-2026-23411

Analysis Generated

Apr 17, 2026 - 12:00 vuln.today

CVE Published

Apr 17, 2026 - 11:52 nvd

MEDIUM 4.3

DescriptionCVE.org

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

AnalysisAI

Dell PowerProtect Data Domain (DD OS) versions 7.7.1.0-8.5, 8.3.1.0-8.3.1.20 (LTS2025), and 7.13.1.0-7.13.1.50 (LTS2024) leak sensitive information to low-privileged remote attackers. An authenticated user with minimal privileges can access confidential data without authorization, resulting in information disclosure with a CVSS score of 4.3. No active exploitation reported, but the low attack complexity and remote network vector make this a practical vulnerability for attackers within administrative networks.

Technical ContextAI

Dell PowerProtect Data Domain is an enterprise backup and deduplication appliance that stores sensitive customer data including backup metadata and system configuration information. The vulnerability stems from inadequate access controls (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the DD OS operating system's data access mechanisms. The flaw allows the system to expose internal data structures or API responses containing sensitive information that should be restricted to higher-privileged accounts. This affects multiple release tracks: Feature Release (7.7.1.0-8.5), LTS2025 (8.3.1.0-8.3.1.20), and LTS2024 (7.13.1.0-7.13.1.50), indicating the vulnerability was introduced in earlier code and persists across multiple maintenance branches.

RemediationAI

Apply the security patches provided in Dell DSA-2026-060; exact patched versions are detailed in that advisory and should be obtained directly from Dell support. If immediate patching is not feasible, implement network segmentation to restrict access to PowerProtect Data Domain management interfaces to authorized administrative networks only, and disable or remove low-privilege user accounts that do not require remote access. Additionally, enforce strong authentication (multi-factor authentication if supported) for all remote administrative access to reduce the risk of account compromise. Monitor access logs and API calls for anomalous data retrieval patterns by low-privilege accounts. These compensating controls do not eliminate the vulnerability but reduce the population of potential attackers and provide detection opportunity; patching remains mandatory for full remediation.