Dell PowerProtect Data Domain: Improper authentication leads to protection bypass
Summary
Dell PowerProtect Data Domain backup appliances running affected DD OS feature, LTS2024, LTS2025 or LTS2026 releases contain an improper authentication flaw (CWE-287). An attacker with a valid low-privileged account and remote network access can bypass protection mechanisms, with high impact on confidentiality and integrity of the appliance. No user interaction is required, but the attacker must already hold valid credentials.
Affected
- Feature Release 7.7.1.0 through 8.8
- LTS2024 release 7.13.1.0 through 7.13.1.80
- LTS2025 release 8.3.1.0 through 8.3.1.40
- LTS2026 release 8.6.1.0 through 8.6.1.20
Fixed in
- Upgrade to 8.9.0.0 or later (Feature Release)
- Upgrade to 7.13.1.90 or later (LTS2024)
- Upgrade to 8.3.1.50 or later (LTS2025)
- Upgrade to 8.6.1.30 or later (LTS2026)
- Fixed builds taken from secondary sources; verify in Dell advisory DSA-2026-416 before rollout.
Workaround
Unknown. No vendor-documented workaround is known. Restrict network access to management interfaces and limit low-privileged accounts until the upgrade is applied.
Exploitation
- No public exploit is known (VulDB).
- Not known to be exploited in the wild (OffSeq). Dell reports no exploitation; CISA KEV does not list the DSA-2026-416 flaws.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Note: CVSS base score differs between sources (8.3 CNA/NVD record, 9.9 VulDB); NVD analysis pending.
Our recommendation
- Patch to the fixed build for your release line in the normal maintenance cycle, earlier if the management interface is reachable from untrusted networks.
- Apply all other DSA-2026-416 fixes on the same appliance, as they ship in the same release.
- Restrict management access to trusted networks and review low-privileged accounts.
- Monitor authentication logs for unusual logins.
- After patching, expect possible false positives from vulnerability scanners.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-416 advisory www.dell.com
- VulDB CVE-2026-103779 vuldb.com
- Brandefense DSA-2026-416 analysis brandefense.io
- OffSeq threat radar CVE-2026-103779 radar.offseq.com
- Strix CVE-2026-103779 www.strix.ai
- Securityonline Dell PowerProtect Data Domain vulnerabilities securityonline.info
- Canadian Cyber Centre Dell advisory AV26-366 www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:10.
Original description (NVD)
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.