Dell PowerProtect Data Domain: Stack-based buffer overflow
Summary
A stack-based buffer overflow in Dell PowerProtect Data Domain (DD OS) allows an unauthenticated remote attacker to potentially execute commands on affected appliances. No authentication is required, and the CVSS 3.1 base score is 9.8 (critical). Data Domain is a disk-based backup and recovery target, so a compromise could endanger the recovery copies that ransomware recovery depends on.
Affected
- Dell PowerProtect Data Domain (DD OS) Feature Release 7.7.1.0 through 8.8
- LTS2024: 7.13.1.0 through 7.13.1.80
- LTS2025: 8.3.1.0 through 8.3.1.40
- LTS2026: 8.6.1.0 through 8.6.1.20
Fixed in
- Feature Release: 8.9.0.0 or later
- LTS2024: 7.13.1.90 or later
- LTS2025: 8.3.1.50 or later
- LTS2026: 8.6.1.30 or later
Source: secondary reports (Brandefense, OffSeq). Confirm the row for CVE-2026-103780 in Dell advisory DSA-2026-416.
Workaround
Unknown. No workaround has been confirmed; a secondary source reports that Dell lists none.
- Until patched, restrict access to the management interface and data-path services to backup networks (analyst recommendation, not from the vendor).
Exploitation
- Exploited in the wild: not known.
- Public proof of concept: none found as of 26 Oct 2026.
- None of the CVEs in the Dell advisory is listed in CISA KEV, according to the research.
- NVD analysis was still pending at the time of research.
Our recommendation
- Inventory all Data Domain and DD Virtual Edition systems, including DDMC-managed units, and map them to the four release lines.
- Patch to the fixed build for your release line in the next maintenance window, after verifying it against Dell DSA-2026-416.
- Restrict management and data-path access to backup networks now, and make sure the appliances are not exposed to the internet.
- Monitor for crashes or unexpected restarts, and recheck the NVD and KEV status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-416 security update www.dell.com
- Brandefense: Dell DSA-2026-416 critical vulnerabilities brandefense.io
- Strix AI: CVE-2026-103780 www.strix.ai
- VulDB: CVE-2026-103780 vuldb.com
- OffSeq Radar: CVE-2026-103780 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:14.
Original description (NVD)
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.