Dell PowerProtect Data Domain: Stack-based buffer overflow
Summary
A stack-based buffer overflow (CWE-121) in DD OS, the operating system of Dell PowerProtect Data Domain backup appliances, allows an attacker with low-privileged remote access to potentially gain unauthorized access. Authentication is required, so an attacker needs a valid low-privileged account on the appliance. CVSS 3.1 base score is 8.8 (High).
Affected
- Feature release 7.7.1.0 through 8.8
- LTS2024 release 7.13.1.0 through 7.13.1.80
- LTS2025 release 8.3.1.0 through 8.3.1.40
- LTS2026 release 8.6.1.0 through 8.6.1.20
Fixed in
- Fixed builds reported by secondary sources citing Dell advisory DSA-2026-416: 8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30
- Unknown: which fixed build applies to each affected release line, including 7.7.1 and 8.8. Verify against Dell's advisory before upgrading.
Workaround
Unknown. No vendor-published workaround found. Dell recommends upgrading.
Exploitation
- Dell reports no exploitation.
- Not listed in CISA KEV.
- No public exploit code found in Metasploit, Exploit-DB or nuclei templates (as of 26 Oct 2026).
- EPSS: 0.37 % (percentile 31).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether any Data Domain appliance in your environment runs an affected version and identify its exposure.
- Upgrade to the fixed build for your release line as soon as possible, after verifying the build in Dell's advisory.
- Restrict management access to administrative networks and make sure the appliance is not reachable from the internet.
- Review whether the other unauthenticated flaws in advisory DSA-2026-416 affect the same systems and patch them in the same window.
- Expect some scanners to report false positives after upgrading, as noted by Dell.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-416 security update advisory www.dell.com
- Strix CVE-2026-86378 details www.strix.ai
- Brandefense: Dell Data Domain critical vulnerabilities (DSA-2026-416) brandefense.io
- OffSeq radar: CVE-2026-86378 radar.offseq.com
- SecurityOnline: Dell PowerProtect Data Domain vulnerabilities securityonline.info
- VulDB entry 427818 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:35.
Original description (NVD)
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.