NCSC-2026-0460
Vulnerability from csaf_ncscnl - Published: 2026-10-30 09:10 - Updated: 2026-10-30 09:10Summary
Kwetsbaarheden verholpen in Dell PowerProtect Data Domain
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Dell heeft meerdere kritieke kwetsbaarheden verholpen in PowerProtect Data Domain, Data Domain Virtual Edition en Data Domain Management Center.
Interpretaties: De kritieke wetsbaarheden met kenmerk CVE-2026-103780, CVE-2026-86384, CVE-2026-86397 en CVE-2026-86400 in Dell PowerProtect Data Domain, hebben een CVSS-score van 9.8. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden op afstand misbruiken om willekeurige opdrachten uit te voeren, inloggegevens te verkrijgen of accounts met verhoogde rechten aan te maken.
Daarnaast heeft Dell drie kritieke kwetsbaarheden verholpen in Data Domain Management Center. De kwetsbaarheden met kenmerken CVE-2026-103799 en CVE-2026-103792 hebben een CVSS-score van 9.6 en CVE-2026-90717 heeft een CVSS-score van 9.1. Een kwaadwillende met beperkte gebruikersrechten kan deze kwetsbaarheden op afstand misbruiken om ongeautoriseerde toegang tot beheerde systemen te verkrijgen, handelingen uit te voeren of verhoogde rechten te verkrijgen.
Dell heeft ook verschillende andere kwetsbaarheden verholpen. Misbruik hiervan kan onder andere leiden tot het uitvoeren van willekeurige opdrachten, het verkrijgen van verhoogde rechten, ongeautoriseerde toegang tot gegevens en verstoring van de dienstverlening.
Oplossingen: Dell heeft updates uitgebracht om de kwetsbaarheden te verhelpen. De kwetsbaarheden zijn verholpen in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) en 8.6.1.30 (LTS2026), of latere versies binnen de betreffende releasebranches. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal
CWE-28: Path Traversal: '..\filedir'
CWE-31: Path Traversal: 'dir\..\..\filename'
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-190: Integer Overflow or Wraparound
CWE-273: Improper Check for Dropped Privileges
CWE-290: Authentication Bypass by Spoofing
CWE-306: Missing Authentication for Critical Function
CWE-321: Use of Hard-coded Cryptographic Key
CWE-354: Improper Validation of Integrity Check Value
CWE-787: Out-of-bounds Write
CWE-862: Missing Authorization
PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024-2026 releases have a Relative Path Traversal vulnerability in the certificate that can enable a high privileged remote attacker to cause a Denial of Service.
6.5 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Dell / PowerProtect Data Domain
|
vers:unknown/* | ||
|
vers:unknown/*
Dell / PowerProtect Data Domain Management Center
|
vers:unknown/* | ||
|
vers:unknown/*
Dell / PowerProtect Data Domain Virtual Edition
|
vers:unknown/* |
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Out-of-bounds Write vulnerability enabling a low privileged remote attacker to cause Denial of Service.
7.6 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a stack-based buffer overflow vulnerability enabling low privileged remote attackers to gain unauthorized access.
8.8 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and select LTS releases contain a high-severity OS command injection vulnerability enabling remote attackers with high privileges to execute arbitrary commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote attackers to bypass protection mechanisms.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including certain LTS2025 and LTS2026 releases, contain a path traversal vulnerability enabling a high privileged remote attacker to cause information disclosure.
6.8 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a vulnerability involving hard-coded cryptographic keys that may allow unauthenticated remote attackers to expose credentials and gain privileged access.
9.8 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain a vulnerability that permits a low privileged remote attacker to potentially escalate privileges due to improper privilege drop verification.
8.8 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote code execution.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Missing Authorization vulnerability allowing low privileged remote attackers unauthorized access.
6.5 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain an authentication bypass by spoofing vulnerability enabling low privileged remote attackers to cause denial of service.
6.4 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a high-severity OS Command Injection vulnerability enabling high privileged remote attackers to execute arbitrary commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing low privileged remote attackers to execute arbitrary commands.
8.8 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to create privileged accounts and gain full system control.
9.8 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a path traversal vulnerability enabling low privileged remote attackers to gain unauthorized filesystem access.
8.8 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to execute arbitrary commands with root privileges.
9.8 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and various LTS releases have an authentication bypass vulnerability enabling low-privileged remote attackers to escalate privileges and affect other managed Data Domain systems.
9.1 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a vulnerability in integrity check validation that allows a high privileged local attacker to bypass protection mechanisms.
6.7 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Path Traversal vulnerability enabling a high privileged local attacker to cause Denial of Service.
6.0 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged local attackers to escalate privileges.
6.3 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.
6.7 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Access Control vulnerability enabling unauthenticated remote attackers to cause denial of service.
6.5 (Medium)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS2024, LTS2025, and LTS2026 releases have a Path Traversal vulnerability enabling high privileged remote attackers to execute commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS releases have a Process Control vulnerability enabling a high privileged remote attacker to bypass protection mechanisms.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an Improper Authentication vulnerability allowing low privileged remote attackers to bypass protection mechanisms.
8.3 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a stack-based buffer overflow vulnerability enabling unauthenticated remote command execution.
9.8 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an SQL Injection vulnerability enabling low-privileged remote attackers to gain unauthorized access to managed systems.
9.6 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations on managed systems.
9.6 (Critical)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations.
7.1 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.
7.2 (High)
Affected products
Known affected
3 products, the same list as for
CVE-2026-68866
References
35 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Dell heeft meerdere kritieke kwetsbaarheden verholpen in PowerProtect Data Domain, Data Domain Virtual Edition en Data Domain Management Center.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kritieke wetsbaarheden met kenmerk CVE-2026-103780, CVE-2026-86384, CVE-2026-86397 en CVE-2026-86400 in Dell PowerProtect Data Domain, hebben een CVSS-score van 9.8. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden op afstand misbruiken om willekeurige opdrachten uit te voeren, inloggegevens te verkrijgen of accounts met verhoogde rechten aan te maken. \n\nDaarnaast heeft Dell drie kritieke kwetsbaarheden verholpen in Data Domain Management Center. De kwetsbaarheden met kenmerken CVE-2026-103799 en CVE-2026-103792 hebben een CVSS-score van 9.6 en CVE-2026-90717 heeft een CVSS-score van 9.1. Een kwaadwillende met beperkte gebruikersrechten kan deze kwetsbaarheden op afstand misbruiken om ongeautoriseerde toegang tot beheerde systemen te verkrijgen, handelingen uit te voeren of verhoogde rechten te verkrijgen.\n\nDell heeft ook verschillende andere kwetsbaarheden verholpen. Misbruik hiervan kan onder andere leiden tot het uitvoeren van willekeurige opdrachten, het verkrijgen van verhoogde rechten, ongeautoriseerde toegang tot gegevens en verstoring van de dienstverlening.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Dell heeft updates uitgebracht om de kwetsbaarheden te verhelpen. De kwetsbaarheden zijn verholpen in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) en 8.6.1.30 (LTS2026), of latere versies binnen de betreffende releasebranches. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "general",
"text": "Path Traversal: \u0027..\\filedir\u0027",
"title": "CWE-28"
},
{
"category": "general",
"text": "Path Traversal: \u0027dir\\..\\..\\filename\u0027",
"title": "CWE-31"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Improper Check for Dropped Privileges",
"title": "CWE-273"
},
{
"category": "general",
"text": "Authentication Bypass by Spoofing",
"title": "CWE-290"
},
{
"category": "general",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "general",
"text": "Use of Hard-coded Cryptographic Key",
"title": "CWE-321"
},
{
"category": "general",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities"
}
],
"title": "Kwetsbaarheden verholpen in Dell PowerProtect Data Domain",
"tracking": {
"current_release_date": "2026-10-30T09:10:19.353296Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0460",
"initial_release_date": "2026-10-30T09:10:19.353296Z",
"revision_history": [
{
"date": "2026-10-30T09:10:19.353296Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "PowerProtect Data Domain"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "PowerProtect Data Domain Management Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "PowerProtect Data Domain Virtual Edition"
}
],
"category": "vendor",
"name": "Dell"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-68866",
"cwe": {
"id": "CWE-23",
"name": "Relative Path Traversal"
},
"notes": [
{
"category": "other",
"text": "Relative Path Traversal",
"title": "CWE-23"
},
{
"category": "description",
"text": "PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024-2026 releases have a Relative Path Traversal vulnerability in the certificate that can enable a high privileged remote attacker to cause a Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-68866 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-68866.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-68866"
},
{
"cve": "CVE-2026-86377",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Out-of-bounds Write vulnerability enabling a low privileged remote attacker to cause Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86377 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86377.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86377"
},
{
"cve": "CVE-2026-86378",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a stack-based buffer overflow vulnerability enabling low privileged remote attackers to gain unauthorized access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86378 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86378.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86378"
},
{
"cve": "CVE-2026-86379",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and select LTS releases contain a high-severity OS command injection vulnerability enabling remote attackers with high privileges to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86379 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86379.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86379"
},
{
"cve": "CVE-2026-86380",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote attackers to bypass protection mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86380 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86380.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86380"
},
{
"cve": "CVE-2026-86383",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including certain LTS2025 and LTS2026 releases, contain a path traversal vulnerability enabling a high privileged remote attacker to cause information disclosure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86383 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86383.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86383"
},
{
"cve": "CVE-2026-86384",
"cwe": {
"id": "CWE-321",
"name": "Use of Hard-coded Cryptographic Key"
},
"notes": [
{
"category": "other",
"text": "Use of Hard-coded Cryptographic Key",
"title": "CWE-321"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a vulnerability involving hard-coded cryptographic keys that may allow unauthenticated remote attackers to expose credentials and gain privileged access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86384 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86384.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86384"
},
{
"cve": "CVE-2026-86385",
"cwe": {
"id": "CWE-273",
"name": "Improper Check for Dropped Privileges"
},
"notes": [
{
"category": "other",
"text": "Improper Check for Dropped Privileges",
"title": "CWE-273"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain a vulnerability that permits a low privileged remote attacker to potentially escalate privileges due to improper privilege drop verification.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86385.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86385"
},
{
"cve": "CVE-2026-86389",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote code execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86389 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86389.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86389"
},
{
"cve": "CVE-2026-86390",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Missing Authorization vulnerability allowing low privileged remote attackers unauthorized access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86390 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86390.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86390"
},
{
"cve": "CVE-2026-86391",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"notes": [
{
"category": "other",
"text": "Authentication Bypass by Spoofing",
"title": "CWE-290"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain an authentication bypass by spoofing vulnerability enabling low privileged remote attackers to cause denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86391 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86391.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86391"
},
{
"cve": "CVE-2026-86393",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86393 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86393.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86393"
},
{
"cve": "CVE-2026-86394",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86394 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86394.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86394"
},
{
"cve": "CVE-2026-86395",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a high-severity OS Command Injection vulnerability enabling high privileged remote attackers to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86395 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86395.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86395"
},
{
"cve": "CVE-2026-86396",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing low privileged remote attackers to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86396 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86396.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86396"
},
{
"cve": "CVE-2026-86397",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to create privileged accounts and gain full system control.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86397 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86397.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86397"
},
{
"cve": "CVE-2026-86398",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a path traversal vulnerability enabling low privileged remote attackers to gain unauthorized filesystem access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86398.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86398"
},
{
"cve": "CVE-2026-86399",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86399 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86399.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86399"
},
{
"cve": "CVE-2026-86400",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to execute arbitrary commands with root privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86400 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86400.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-86400"
},
{
"cve": "CVE-2026-90717",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"notes": [
{
"category": "other",
"text": "Authentication Bypass by Spoofing",
"title": "CWE-290"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and various LTS releases have an authentication bypass vulnerability enabling low-privileged remote attackers to escalate privileges and affect other managed Data Domain systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90717 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90717.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90717"
},
{
"cve": "CVE-2026-90718",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90718 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90718.json"
}
],
"title": "CVE-2026-90718"
},
{
"cve": "CVE-2026-90720",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a vulnerability in integrity check validation that allows a high privileged local attacker to bypass protection mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90720 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90720.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90720"
},
{
"cve": "CVE-2026-90726",
"cwe": {
"id": "CWE-28",
"name": "Path Traversal: \u0027..\\filedir\u0027"
},
"notes": [
{
"category": "other",
"text": "Path Traversal: \u0027..\\filedir\u0027",
"title": "CWE-28"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Path Traversal vulnerability enabling a high privileged local attacker to cause Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90726 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90726.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90726"
},
{
"cve": "CVE-2026-90728",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged local attackers to escalate privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90728 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90728.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90728"
},
{
"cve": "CVE-2026-90729",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90729 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90729.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90729"
},
{
"cve": "CVE-2026-90730",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Access Control vulnerability enabling unauthenticated remote attackers to cause denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-90730 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90730.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-90730"
},
{
"cve": "CVE-2026-94346",
"cwe": {
"id": "CWE-31",
"name": "Path Traversal: \u0027dir\\..\\..\\filename\u0027"
},
"notes": [
{
"category": "other",
"text": "Path Traversal: \u0027dir\\..\\..\\filename\u0027",
"title": "CWE-31"
},
{
"category": "description",
"text": "PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS2024, LTS2025, and LTS2026 releases have a Path Traversal vulnerability enabling high privileged remote attackers to execute commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-94346 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94346.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-94346"
},
{
"cve": "CVE-2026-94347",
"notes": [
{
"category": "description",
"text": "PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS releases have a Process Control vulnerability enabling a high privileged remote attacker to bypass protection mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-94347 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94347.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-94347"
},
{
"cve": "CVE-2026-103779",
"notes": [
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an Improper Authentication vulnerability allowing low privileged remote attackers to bypass protection mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-103779 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103779.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-103779"
},
{
"cve": "CVE-2026-103780",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a stack-based buffer overflow vulnerability enabling unauthenticated remote command execution.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-103780 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103780.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-103780"
},
{
"cve": "CVE-2026-103792",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an SQL Injection vulnerability enabling low-privileged remote attackers to gain unauthorized access to managed systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-103792 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103792.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-103792"
},
{
"cve": "CVE-2026-103799",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations on managed systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-103799 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103799.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-103799"
},
{
"cve": "CVE-2026-110540",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-110540 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110540.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-110540"
},
{
"cve": "CVE-2026-110541",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
},
{
"category": "description",
"text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-110541 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110541.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2026-110541"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.