What is the CVSS score of CVE-2026-53481?

CVE-2026-53481 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-53481?

24 hours: Identify all PowerProtect DD OS systems within the affected version ranges; apply firewall rules restricting network access to these systems to trusted administrative networks only. 7 days: Implement network isolation of affected systems from production and user-facing networks; enable comprehensive logging and alerting for administrative and API access; assess readiness for vendor patches or major version upgrades. 30 days: Develop tested migration plan to unaffected DD OS versions once patches are released; validate compensating controls effectiveness; document and approve timeline for full remediation.

PowerProtect Data Domain CVE-2026-53481

Q: Which versions of PowerProtect Data Domain are affected by CVE-2026-53481?

Dell PowerProtect Data Domain backup systems in versions 7.7.1.0-8.7, LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70) can be completely compromised by remote…. A patch is available.

EUVD-2026-42038 CRITICAL

Path Traversal (CWE-22)

2026-07-07 dell

GHSA-jc2f-55p8-6hmw

Authentication Bypass Path Traversal Dell Powerprotect Data Domain

9.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Dell describes unauthenticated remote path traversal escalating to complete system control, supporting AV:N/AC:L/PR:N/UI:N with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 14:01 EUVD

Analysis Generated

Jul 07, 2026 - 13:38 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to the system. This is a critical severity vulnerability as it allows an attacker to take complete control of system; so Dell recommends customers to upgrade at the earliest opportunity.

AnalysisAI

Path traversal leading to full system compromise affects Dell PowerProtect Data Domain (DD OS) versions 7.7.1.0 through 8.7, plus the LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70) branches. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker can traverse outside the intended directory to gain unauthorized access and, according to Dell, take complete control of the system. Dell rates this critical (9.8) and its tags note an authentication-bypass characteristic; no public exploit identified at time of analysis and it is not currently in CISA KEV.

Technical ContextAI

PowerProtect Data Domain (formerly EMC Data Domain, running DD OS) is Dell's purpose-built backup and deduplication appliance line, a core component of enterprise data-protection and disaster-recovery stacks that stores and manages backup data over network-facing management and data services. The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), in which user-supplied path input is not properly canonicalized or constrained, allowing sequences such as '../' to escape the intended directory and reach files or resources outside it. The CPE 'cpe:2.3:a:dell:powerprotect_data_domain:*' identifies the affected product but uses a wildcard version, so the authoritative version scoping comes from Dell's advisory text rather than the CPE. The supplied 'Authentication Bypass' tag suggests the traversal may be reachable without credentials, consistent with the PR:N metric, and Dell states the outcome can escalate to complete system control.

RemediationAI

Patch available per vendor advisory - Dell DSA-2026-278 instructs customers to upgrade DD OS to the fixed release for their branch at the earliest opportunity; the input does not enumerate exact fixed build numbers, so consult DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities) to select the correct fixed version for your mainline, LTS2026, LTS2025, or LTS2024 track before applying it during a maintenance window. Because the flaw is remotely reachable and unauthenticated, prioritize appliances whose management or data-service interfaces are exposed. Until patched, compensating controls include restricting network reachability of the Data Domain management and service endpoints to a dedicated management VLAN or backup network and blocking them at the firewall from general user and internet-facing segments, and tightening access-control lists to trusted admin hosts only; the trade-off is that overly aggressive filtering can disrupt legitimate backup/replication traffic and remote administration, so validate that DD Boost, replication, and management paths from authorized systems remain functional.