Description
Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege
management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.
Published: 2026-04-20
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch
AI Analysis

Impact

Updated information indicates an improper privilege management flaw in Dell PowerProtect Data Domain appliances. The vulnerability allows a local high‑privileged attacker to elevate privileges and execute unauthorized delete operations. This issue is categorized as CWE‑269 (Access Control).

Affected Systems

The vulnerability affects Dell PowerProtect Data Domain appliances running firmware versions 7.7.1.0 through 8.6.0.0 and 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of <1% shows low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. An attacker with local high‑privilege access could exploit this flaw to elevate privileges and delete protected data. Because the attack requires local high‑privilege conditions, it is unlikely to be leveraged remotely, but within a compromised environment the risk remains significant.

Generated by OpenCVE AI on October 17, 2026 at 10:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain firmware update released in Dell Security Advisory 2026‑060, which addresses the privilege escalation flaw.
  • Reboot the appliance to ensure the firmware changes take effect.
  • Limit local user accounts to least privilege and enforce strict access controls for the appliance.

Generated by OpenCVE AI on October 17, 2026 at 10:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Title Improper Privilege Management Vulnerability Allowing Privilege Escalation in Dell PowerProtect Data Domain

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation. Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.

Wed, 05 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
Title Improper Privilege Management Vulnerability Allowing Privilege Escalation in Dell PowerProtect Data Domain

Tue, 04 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation. Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.

Mon, 11 May 2026 09:45:00 +0000

Type Values Removed Values Added
Title IDRAC Privilege Escalation via Improper Access Control

Mon, 11 May 2026 08:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability in IDRAC. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation in IDRAC. Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.

Tue, 28 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Dell data Domain Operating System
CPEs cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*
Vendors & Products Dell data Domain Operating System

Wed, 22 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Mon, 20 Apr 2026 19:00:00 +0000

Type Values Removed Values Added
Title IDRAC Privilege Escalation via Improper Access Control

Mon, 20 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability in IDRAC. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation in IDRAC.
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-14T14:14:34.508Z

Reserved: 2026-04-01T17:04:27.475Z

Link: CVE-2026-35154

cve-icon Vulnrichment

Updated: 2026-04-20T18:08:38.657Z

cve-icon NVD

Status : Modified

Published: 2026-04-20T17:16:34.263

Modified: 2026-10-14T15:17:20.130

Link: CVE-2026-35154

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T10:15:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management