What is the CVSS score of CVE-2026-53483?

CVE-2026-53483 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of PowerProtect Data Domain are affected by CVE-2026-53483?

Dell PowerProtect Data Domain versions 7.7.1.0-8.8 and all long-term support branches contain a critical remote authentication bypass (CVSS 9.8) allowing unauthorized access without credentials,…. A patch is available.

How to fix or mitigate CVE-2026-53483?

24 hours: Inventory all Dell PowerProtect Data Domain instances; determine exact versions; immediately restrict network access to trusted administrative subnets only via firewall rules and network segmentation. 7 days: Contact Dell support for security guidance and patch timelines; test isolated lab access to any interim updates when available. 30 days: Execute deployment plan for patched versions when released by vendor; until then, maintain compensating network controls and validate backup redundancy on separate, isolated infrastructure.

PowerProtect Data Domain CVE-2026-53483

EUVD-2026-42036 CRITICAL

Improper Authentication (CWE-287)

2026-07-07 dell

GHSA-crf6-f3jp-fmm4

Authentication Bypass Dell Powerprotect Data Domain

9.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes unauthenticated remote authentication bypass yielding complete system control, so AV:N/PR:N/UI:N with full C/I/A high; scope unchanged as impact is confined to the appliance.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 14:01 EUVD

Analysis Generated

Jul 07, 2026 - 13:30 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 an improper authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This is a critical severity vulnerability as it allows an attacker to take complete control of system; so Dell recommends customers to upgrade at the earliest opportunity.

AnalysisAI

Improper authentication in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025, and LTS2024 branches) lets an unauthenticated, remote attacker bypass authentication and gain unauthorized access that Dell says can escalate to complete system control. Dell rates it critical (CVSS 9.8, CWE-287). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the network-facing, no-privilege attack profile makes it a high-priority patch for backup/data-protection infrastructure.

Technical ContextAI

PowerProtect Data Domain is Dell's purpose-built backup and deduplication appliance line (protection storage), commonly deployed as the backend target for enterprise backup software and DR pipelines. The flaw is classified CWE-287 (Improper Authentication), meaning the authentication mechanism can be circumvented or fails to correctly verify identity - as opposed to a missing check (CWE-306) or credential theft. Because Data Domain systems mediate access to an organization's backup copies (often the last line of defense against ransomware), an authentication bypass on the management/network interface is especially consequential. The single CPE provided (cpe:2.3:a:dell:powerprotect_data_domain) confirms the affected component is the Data Domain application/DD OS software across all listed release trains.

RemediationAI

Upgrade Dell PowerProtect Data Domain / DD OS to a fixed release per Dell advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); the input does not enumerate the exact fixed build numbers, so consult the advisory for the precise target version matching your release train (mainline, LTS2026, LTS2025, or LTS2024) and apply it at the earliest opportunity as Dell recommends. As compensating controls until patched, restrict network reachability of the Data Domain management interfaces by placing appliances on an isolated backup/management VLAN and blocking access from general user networks, limit management access to a small set of trusted administrative hosts via ACLs, and increase monitoring/alerting on authentication and administrative activity on the appliance - trade-off: network restrictions may disrupt backup jobs or management tooling that legitimately reach the appliance, so validate connectivity requirements before locking down. No vendor-specified non-patch workaround is cited in the available data, so upgrading is the authoritative fix.