EUVD-2026-42236
GHSA-3745-2pcg-39jf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable stored XSS needing no attacker auth (PR:N) but a victim view (UI:R); script crossing into the browser context is a scope change (S:C) with low C/I/A impact.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
AnalysisAI
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS2025 8.3.1.x, and LTS2024 7.13.1.x branches) lets a remote attacker persist malicious script in the appliance management interface that executes in other users' browser sessions. Because the flaw is reachable without authentication and the injected payload runs in the victim's authenticated context, an attacker can achieve information disclosure, session/token theft, and client-side request forgery against operators of the backup appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Dell has published advisory DSA-2026-278.
Technical ContextAI
PowerProtect Data Domain is Dell's protection-storage / deduplication backup appliance line (formerly EMC Data Domain), managed through the DD System Manager web console. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored/persistent variant: user-controllable input is written to persistent storage and later rendered into an HTML response served by the management UI without adequate output encoding or contextual sanitization. When an operator loads the affected page, the browser parses the attacker-controlled data as active script rather than inert text. The advisory references DD OS across four maintenance trains (mainline 7.7.1.0-8.7, LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, LTS2024 7.13.1.0-7.13.1.70); no machine-readable CPE strings were supplied in the intelligence, so exact affected-configuration matching should be validated against Dell's DSA-2026-278 knowledge-base article.
RemediationAI
Patch available per vendor advisory: upgrade DD OS to the fixed maintenance build for your release train as listed in Dell DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); exact fixed version numbers were not supplied in the input data and must be read from that advisory rather than assumed. Until patched, restrict network access to the DD System Manager management interface to a dedicated administrative VLAN or jump host and block it from general user and internet-facing networks, which reduces who can plant or trigger the payload at the cost of requiring admins to reach the console through the restricted path. Administrators should also avoid opening the management UI with browsers that hold other sensitive sessions and can clear/rotate management session tokens after suspected exposure; a browser Content-Security-Policy or script-blocking extension on admin workstations offers partial defense-in-depth but is not a substitute for the vendor fix.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today