Dell PowerProtect Data Domain: Path traversal enables filesystem access
Summary
Dell PowerProtect Data Domain (DD OS) contains a path traversal flaw (CWE-22). A remote attacker with low privileges can use it to access the filesystem. The CNA rates the impact as high for confidentiality, integrity and availability. No exploitation in the wild and no public proof of concept are known at publication.
Affected
- Feature Release 7.7.1.0 through 8.8
- LTS2024 release 7.13.1.0 through 7.13.1.80
- LTS2025 release 8.3.1.0 through 8.3.1.40
- LTS2026 release 8.6.1.0 through 8.6.1.20
Fixed in
- Fixed builds according to the CVE record: 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30
- Verify the exact fixed build for each branch in Dell advisory DSA-2026-416 before rollout, because the advisory table row could not be checked directly.
Workaround
- No patch-free workaround is documented. Dell recommends upgrading.
- Interim measures: restrict management and remote access to trusted admin networks, limit accounts to least privilege and review access logs for unusual file access.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept confirmed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS: 0.34 %.
Our recommendation
- Upgrade to the fixed builds at the earliest opportunity, within your high-severity patch window.
- Check with a scan whether any management interface is reachable from the internet and restrict access if it is.
- Keep the list of accounts short, use least privilege and audit it.
- Review access logs for unusual file access and check CISA KEV again before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell advisory DSA-2026-416 www.dell.com
- Strix.ai CVE-2026-86398 www.strix.ai
- OffSeq threat radar CVE-2026-86398 radar.offseq.com
- TheHackerWire CVE-2026-86398 www.thehackerwire.com
- Brandefense summary of DSA-2026-416 brandefense.io
- Securityonline: Dell PowerProtect Data Domain vulnerabilities securityonline.info
- VulDB 427792 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:37.
Original description (NVD)
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.