CVE-2026-26354

Stack-Based Buffer Overflow Enabling Remote Command Execution in Dell PowerProtect Data Domain

Published Apr 22, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Analysis

Technical impact

A stack-based buffer overflow in the Domain Operating System allows an attacker to execute arbitrary commands. The flaw propagates executable code without authentication, enabling a full takeover of the affected system. It stems from improper bounds checking and is classed as a buffer overflow vulnerability.

Affected Systems

Dell PowerProtect Data Domain appliances running Domain Operating System Feature Release versions from 7.7.1.0 through 8.6, LTS2025 releases 8.3.1.0 to 8.3.1.10, and LTS2024 releases 7.13.1.0 to 7.13.1.60 are affected.

Risk and Exploitability

The CVSS score of 8.1 classifies this as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, but the vulnerability remains unauthenticated and remotely exploitable with no prerequisite access, meaning an external attacker could trigger it. The vulnerability is not currently cataloged in CISA's KEV list.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

PowerProtect Data Domain

unaffected

Version	Status	Constraints
`0`	affected	< 8.6.1.10, 8.7.0.0 or later
`0`	affected	< 8.3.1.20 or later
`0`	affected	< 7.13.1.60 or later
`0`	affected	< 2.7.9 with DD OS 8.3.1.30

Configuration 1 [-]

OR	cpe:2.3:a:dell:powerprotect_dp_series_appliance::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::

No data.

Vendor Product Versions

Dell

Powerprotect Data Domain

Version	Status	Scheme	Platform
`8.6.1.10, 8.7.0.0 or later`	affected	generic	—
`8.3.1.20 or later`	affected	generic	—
`7.13.1.60 or later`	affected	generic	—
`2.7.9 with DD OS 8.3.1.30`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Download and apply Dell PowerProtect Data Domain DSA-2026-060 security update
Restrict external network access to the appliance by blocking or limiting traffic to the vulnerable ports until the patch is applied
Disable or restrict the vulnerable service or component that is exposed via the Domain Operating System, following Dell's temporary configuration guidelines

Generated by OpenCVE AI on April 28, 2026 at 20:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.504% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

History

Apr 28, 2026 9:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Stack-Based Buffer Overflow Enabling Remote Command Execution in Dell PowerProtect Data Domain

Apr 27, 2026 5:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell data Domain Operating System Dell powerprotect Dp Series Appliance
Weaknesses		CWE-787
CPEs		cpe:2.3:a:dell:powerprotect_dp_series_appliance:::::::: cpe:2.3:o:dell:data_domain_operating_system::::::::
Vendors & Products		Dell data Domain Operating System Dell powerprotect Dp Series Appliance

Apr 22, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell powerprotect Data Domain
Vendors & Products		Dell Dell powerprotect Data Domain

Apr 22, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 22, 2026 6:30 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Weaknesses		CWE-121
References		https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`