Dell fixes four CVSS 9.8 flaws in PowerProtect Data Domain

Dell fixes four CVSS 9.8 flaws in PowerProtect Data Domain

19 October 2026: Dell has updated advisory DSA-2026-416 for PowerProtect Data Domain with four flaws rated CVSS 9.8 that an attacker with network access and no credentials could use to run commands as root, recover credentials from a hard-coded key or create a privileged account. They affect DD OS 7.7.1.0 through 8.8.0.0 and the three long-term support lines, and are fixed in 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Dell rates the advisory critical, reports no exploitation and tells customers to upgrade "at the earliest opportunity".

Not yet independently verified. Dell reports no exploitation. The critical proprietary flaws were added in revision 3.0 of 19 October; NCSC-NL published its advisory on 30 October, and no independent analysis of the flaws has appeared yet. We will update this when it can be confirmed, and remove this note.

The four unauthenticated flaws

All four sit in Dell's own code in DD OS, the operating system of Data Domain appliances, Data Domain Virtual Edition and APEX Protection Storage:

• CVE-2026-103780, a stack-based buffer overflow leading to command execution;
• CVE-2026-86384, a hard-coded cryptographic key that exposes credentials an attacker can then log in with;
• CVE-2026-86397, improper authentication that lets an attacker create a privileged account;
• CVE-2026-86400, improper authentication that leads to arbitrary commands as root.

Dell says the last two allow an attacker "to take complete control of the system". Three more flaws hit Data Domain Management Center, the console that runs several systems: CVE-2026-103799 (missing authorisation, 9.6), CVE-2026-103792 (SQL injection, 9.6) and CVE-2026-90717 (authentication bypass by spoofing, 9.1). These need a low-privileged account, but each reaches the managed systems, and Dell notes the last "could impact other managed Data Domain systems".

The advisory first appeared on 1 October for third-party components (Apache HTTP Server, OpenSSL, curl, libexpat, Tomcat, nginx and others, about a hundred CVEs in all) and gained the proprietary flaws in revision 3.0 on 19 October.

Fixed releases by line

Line	Affected	Fixed
Feature release	7.7.1.0 to 8.8.0.0	8.9.0.0 or later
LTS2024	7.13.1.0 to 7.13.1.80	7.13.1.90 or later
LTS2025	8.3.1.0 to 8.3.1.40	8.3.1.50 or later
LTS2026	8.6.1.0 to 8.6.1.20	8.6.1.30 or later

The same versions apply to appliances, Virtual Edition, APEX Protection Storage and Management Center. Some third-party fixes arrived one build earlier on each LTS line (7.13.1.80, 8.3.1.40, 8.6.1.20), so a system already on those still needs the newer build for the critical flaws.

Why backup targets need this first

A Data Domain system usually holds the copies an organisation would restore from after ransomware, which is why attackers look for its management interfaces first. Root on the appliance means the ability to delete or encrypt backups and retention locks along with the production data. Until the upgrade is in, the management and REST interfaces should be reachable only from an administrative network, and new local accounts or unexplained configuration changes on the appliance are the thing to look for in its audit logs.

Our server backup software category lists 20 products.

Company profile on TrustList: Dell Technologies

Related on TrustList:

• Veeam fixes a critical authorization bypass in Backup & Replication 13
• Commvault patches critical command execution flaw in its CVFS storage
• Dell System Update 2.3.0.0 fixes a critical unauthenticated root code-execution flaw (CVE-2026-86360) and four high-severity bugs

Sources

• Dell: DSA-2026-416, Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities (revision 3.0), 19 October 2026
• NCSC-NL: NCSC-2026-0460, kwetsbaarheden verholpen in Dell PowerProtect Data Domain, 30 October 2026