EUVD-2026-42240
GHSA-gc2x-3r66-52fv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management interface (AV:N) exploitable at low complexity by an existing low-privileged account (PR:L), yielding full authorization bypass with high C/I/A on the appliance.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
AnalysisAI
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6.1.0-8.6.1.10, 8.3.1.0-8.3.1.30, and 7.13.1.0-7.13.1.70) allows a low-privileged, remote authenticated attacker to reach resources or actions beyond their assigned role, resulting in unauthorized access. Rated CVSS 8.8 (High) with high confidentiality, integrity, and availability impact and low attack complexity. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low barrier to exploitation for any existing account makes this a meaningful escalation risk on these backup appliances.
Technical ContextAI
Dell PowerProtect Data Domain is a purpose-built deduplication storage appliance used as the backend for enterprise backup and disaster-recovery pipelines, exposing management interfaces (DD System Manager/DD OS CLI and APIs) over the network. The flaw is classified as CWE-863 (Incorrect Authorization), meaning the software performs an authorization check but applies it incorrectly - the wrong role/permission model is evaluated or a privileged operation is not gated to the appropriate role. As a result, a user who has already authenticated with limited privileges can invoke functionality or read/modify data that should be restricted to higher-privileged administrators. Because this is a logic/authorization defect rather than a memory-safety bug, exploitation typically involves calling an otherwise-protected function or endpoint with a low-privileged session.
RemediationAI
Patch available per vendor advisory (Dell DSA-2026-278); apply the fixed DD OS release for your specific branch as listed in that advisory (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities) - the input does not enumerate an exact fixed build per branch, so use the advisory to map your running version (mainline 7.7.1.0-8.6, LTS2026 8.6.1.x, LTS2025 8.3.1.x, or LTS2024 7.13.1.x) to its patched release rather than assuming a version number. Until you can upgrade, reduce exposure by restricting network reachability of the DD System Manager UI, CLI (SSH), and management/REST API to a dedicated management VLAN or jump host and tightly scoping which accounts exist, since exploitation requires a valid low-privileged session; the trade-off is reduced administrative convenience and possible disruption to automation that talks to the management interface. Additionally review and prune low-privileged local and directory-mapped accounts and audit management-interface logs for anomalous privileged actions, accepting that this monitoring detects but does not prevent abuse.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today