EUVD-2026-41535
GHSA-4qv9-ccwq-64wv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible management interface requires valid low-privileged credentials (PR:L); impact is limited to integrity tampering only, with no confidentiality or availability effect.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.
AnalysisAI
Improper access control in the RBAC implementation of Dell PowerProtect Data Domain allows a low-privileged authenticated remote attacker to tamper with information beyond their authorized role scope. Affected releases span the main 7.7.1.0-8.6 line and three LTS tracks covering LTS2024, LTS2025, and LTS2026. No public exploit code has been identified and exploitation has not been confirmed by CISA KEV, placing this as a medium-priority issue requiring patch scheduling rather than emergency response.
Technical ContextAI
Dell PowerProtect Data Domain is an enterprise data protection and deduplication appliance used for backup, archive, and disaster recovery workloads. The vulnerability resides in the Role-Based Access Control (RBAC) subsystem - the authorization layer that enforces privilege boundaries between user roles such as backup administrators, operators, and read-only users. CWE-284 (Improper Access Control) indicates that role enforcement logic fails to adequately gate certain operations, allowing a user operating within a low-privileged role to perform write or modification actions that should be restricted to higher-privileged roles. The flaw is reachable over the network (AV:N), suggesting it manifests in an API or management interface endpoint that performs insufficient role-boundary validation before acting on the request.
RemediationAI
Apply the update detailed in Dell Security Advisory DSA-2026-278, available at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. The advisory covers multiple vulnerabilities simultaneously, so applying it addresses this RBAC flaw along with any co-disclosed issues. No exact fixed version number was independently confirmed from the input data - consult the advisory directly to determine the target upgrade version for your release track (main-line, LTS2024, LTS2025, or LTS2026). As an interim compensating control pending patching, restrict management interface access to trusted administrative networks via firewall rules or VPN, and audit current low-privileged user accounts to ensure only authorized personnel hold credentials; reducing the attacker surface to credentialed insiders limits realistic exploitation. Enabling enhanced audit logging on the RBAC and management API layer can help detect anomalous role-boundary access attempts.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today