Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
Published: 2026-07-03
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Dell PowerProtect Data Domain firmware contains an incorrect permission assignment for a critical resource, as identified by CWE-732. An attacker with high‑privileged local access could use this flaw to access or modify data or settings that should not be freely available, allowing unauthorized control over protected resources.

Affected Systems

Affected are Dell PowerProtect Data Domain firmware versions 7.7.1.0 through 8.6, LTS2026 releases 8.6.1.0 to 8.6.1.10, LTS2025 releases 8.3.1.0 to 8.3.1.30, and LTS2024 releases 7.13.1.0 to 7.13.1.70.

Risk and Exploitability

The CVSS score of 4.4 indicates a moderate overall risk, while the EPSS score of < 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires local high‑privileged access, and it does not provide remote code execution or full system compromise.

Generated by OpenCVE AI on July 21, 2026 at 09:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update published in the Dell KB article (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities).
  • Limit local privileged accounts to those strictly necessary for operation, avoiding unnecessary high‑privilege rights that grant access to critical resources.
  • Enable auditing of critical resource access and configure alerts to detect unauthorized usage.

Generated by OpenCVE AI on July 21, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment in Dell PowerProtect Data Domain Firmware

Wed, 15 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment in Dell PowerProtect Data Domain Firmware

Mon, 13 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Allows Unauthorized Access on Dell PowerProtect Data Domain

Sun, 12 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Allows Unauthorized Access on Dell PowerProtect Data Domain

Sat, 11 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment of Critical Resource Enables Unauthorized Access in Dell PowerProtect Data Domain

Fri, 10 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment of Critical Resource Enables Unauthorized Access in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Enables Local Privileged Access to Critical Resources in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Enables Local Privileged Access to Critical Resources in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Leading to Unauthorized Access in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Leading to Unauthorized Access in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain Incorrect Permission Assignment Allows Unauthorized Local Access

Sun, 05 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain Incorrect Permission Assignment Allows Unauthorized Local Access

Sat, 04 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Leading to Unauthorized Local Access

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Incorrect Permission Assignment Leading to Unauthorized Local Access

Fri, 03 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
Weaknesses CWE-732
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-06T14:22:01.012Z

Reserved: 2026-05-05T17:04:45.713Z

Link: CVE-2026-44268

cve-icon Vulnrichment

Updated: 2026-07-06T14:21:29.054Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:00:04Z

Weaknesses
  • CWE-732

    Incorrect Permission Assignment for Critical Resource