Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.
Published: 2026-07-03
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Dell PowerProtect Data Domain contains an externally controlled format string vulnerability (CWE‑134). A high‑privileged attacker who can reach the appliance remotely can send crafted input that is processed in a way that allows the attacker to read sensitive information from memory and, in some cases, cause the application to crash. The vulnerability allows the attacker to compromise confidentiality and availability of the data domain services.

Affected Systems

Dell PowerProtect Data Domain appliances running firmware versions 7.7.1.0 through 8.7, LTS2026 releases 8.6.1.0 through 8.6.1.10, LTS2025 releases 8.3.1.0 through 8.3.1.30, and LTS2024 releases 7.13.1.0 through 7.13.1.70 are affected.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA KEV. Exploitation requires a high‑privileged remote attacker; the issue is unlikely to be triggered by anonymous or limited‑access users.

Generated by OpenCVE AI on July 21, 2026 at 09:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell DSA‑2026‑278 security update for PowerProtect Data Domain to address the format string vulnerability.
  • Restrict remote administrative access to the appliance, using network segmentation or firewall rules until the update is applied.
  • Validate and sanitize any user‑supplied format strings before processing them to prevent format string handling.

Generated by OpenCVE AI on July 21, 2026 at 09:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Format String Vulnerability in Dell PowerProtect Data Domain Allowing Information Disclosure and Denial of Service

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Format String Vulnerability in Dell PowerProtect Data Domain Allowing Information Disclosure and Denial of Service

Thu, 16 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain format string vulnerability causing information disclosure and denial of service

Tue, 14 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain format string vulnerability causing information disclosure and denial of service

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 05:45:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Fri, 10 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Exploitation in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String Exploitation in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Externally‑controlled Format String Vulnerability in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title Externally‑controlled Format String Vulnerability in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String in Dell PowerProtect Data Domain Enables Information Disclosure and Denial of Service

Sat, 04 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Externally Controlled Format String in Dell PowerProtect Data Domain Enables Information Disclosure and Denial of Service

Sat, 04 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability Allowing Information Disclosure and Denial of Service in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Externally-Controlled Format String Vulnerability Allowing Information Disclosure and Denial of Service in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.
Weaknesses CWE-134
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-06T16:29:09.489Z

Reserved: 2026-05-14T17:05:39.859Z

Link: CVE-2026-46465

cve-icon Vulnrichment

Updated: 2026-07-06T16:29:05.944Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:00:04Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String